From c2df2abc78ccb82e4120532e4944a3cdb0224226 Mon Sep 17 00:00:00 2001 From: George Stykalin Date: Sun, 15 Jun 2025 20:25:45 +0300 Subject: [PATCH] actualized for kubespray version 2.28.0 --- .ansible-lint | 45 + .ansible-lint-ignore | 8 + .gitignore | 6 +- Makefile | 18 + ansible.cfg | 3 +- config.sample.yaml | 2 +- .../group_vars/all/containerd.yml.tmpl | 8 - .../k8s_cluster/k8s-cluster.yml.tmpl | 5 +- .../templates/kubespray/inventory/hosts.tmpl | 4 - .../inventory/group_vars/all/containerd.yml | 15 +- .../group_vars/k8s_cluster/addons.yml | 2 +- .../group_vars/k8s_cluster/k8s-cluster.yml | 19 +- kubespray/inventory/hosts | 36 +- kubespray/project/boilerplate.yml | 66 +- kubespray/project/cluster.yml | 25 +- kubespray/project/facts.yml | 10 +- kubespray/project/install_etcd.yml | 7 +- kubespray/project/recover_control_plane.yml | 6 +- kubespray/project/remove_node.yml | 31 +- kubespray/project/reset.yml | 2 +- .../adduser/molecule/default/molecule.yml | 16 +- .../molecule/default/molecule.yml | 14 +- .../molecule/default/molecule.yml | 47 - .../project/roles/bootstrap-os/tasks/main.yml | 70 +- .../defaults/main.yml | 8 + .../files/bootstrap.sh | 0 .../handlers/main.yml | 0 .../project/roles/bootstrap_os/meta/main.yml | 3 + .../molecule/default/converge.yml | 3 +- .../molecule/default/molecule.yml | 37 + .../molecule/default/tests/test_default.py | 0 .../tasks/amzn.yml | 0 .../tasks/centos.yml | 8 - .../tasks/clear-linux-os.yml} | 0 .../tasks/debian.yml | 0 .../tasks/fedora-coreos.yml | 0 .../tasks/fedora.yml | 0 .../tasks/flatcar.yml | 2 +- .../project/roles/bootstrap_os/tasks/main.yml | 62 + .../tasks/openEuler.yml | 0 .../tasks/opensuse-leap.yml | 0 .../tasks/opensuse-tumbleweed.yml | 0 .../tasks/opensuse.yml | 0 .../tasks/rhel.yml} | 9 +- .../tasks/ubuntu.yml | 8 + .../vars/fedora-coreos.yml | 0 .../vars/flatcar.yml | 0 .../containerd-common/defaults/main.yml | 12 - .../containerd/defaults/main.yml | 15 +- .../containerd/molecule/default/converge.yml | 2 +- .../containerd/molecule/default/molecule.yml | 42 +- .../containerd/molecule/default/prepare.yml | 7 +- .../containerd/tasks/main.yml | 45 +- .../containerd/tasks/reset.yml | 18 - .../containerd/templates/config-v1.toml.j2 | 102 + .../containerd/templates/config.toml.j2 | 84 +- .../templates/containerd.service.j2 | 2 +- .../containerd/templates/hosts.toml.j2 | 6 + .../containerd/vars/debian.yml | 7 - .../containerd/vars/ubuntu.yml | 7 - .../cri-dockerd/defaults/main.yml | 3 + .../cri-dockerd/molecule/default/converge.yml | 2 +- .../cri-dockerd/molecule/default/molecule.yml | 30 +- .../cri-dockerd/molecule/default/prepare.yml | 6 +- .../templates/cri-dockerd.service.j2 | 2 +- .../container-engine/cri-o/defaults/main.yml | 32 +- .../container-engine/cri-o/meta/main.yml | 2 +- .../cri-o/molecule/default/converge.yml | 2 +- .../cri-o/molecule/default/molecule.yml | 50 +- .../cri-o/molecule/default/prepare.yml | 7 +- .../molecule/default/tests/test_default.py | 2 +- .../cri-o/tasks/load_vars.yml | 10 +- .../container-engine/cri-o/tasks/main.yaml | 32 +- .../container-engine/cri-o/tasks/reset.yml | 12 +- .../cri-o/templates/crio.conf.j2 | 20 +- .../container-engine/cri-o/vars/v1.28.yml | 9 - .../container-engine/cri-o/vars/v1.29.yml | 1 + .../container-engine/cri-o/vars/v1.31.yml | 16 + .../container-engine/docker/defaults/main.yml | 6 +- .../container-engine/docker/tasks/main.yml | 2 +- .../docker/tasks/set_facts_dns.yml | 4 +- .../container-engine/docker/vars/debian.yml | 39 +- .../container-engine/docker/vars/fedora.yml | 39 +- .../container-engine/docker/vars/redhat-7.yml | 63 - .../container-engine/docker/vars/redhat.yml | 43 +- .../container-engine/docker/vars/ubuntu.yml | 46 +- .../gvisor/molecule/default/converge.yml | 2 +- .../gvisor/molecule/default/molecule.yml | 4 +- .../gvisor/molecule/default/prepare.yml | 6 +- .../container-engine/kata-containers/OWNERS | 6 - .../molecule/default/converge.yml | 2 +- .../molecule/default/prepare.yml | 6 +- .../validate-container-engine/tasks/main.yml | 6 +- .../youki/molecule/default/converge.yml | 2 +- .../youki/molecule/default/molecule.yml | 4 +- .../youki/molecule/default/prepare.yml | 6 +- .../container-engine/youki/tasks/main.yml | 2 +- .../roles/download/tasks/download_file.yml | 5 +- .../roles/download/tasks/extract_file.yml | 2 +- .../project/roles/download/tasks/main.yml | 2 +- .../download/tasks/prep_kubeadm_images.yml | 24 +- .../download/templates/kubeadm-images.yaml.j2 | 6 +- .../project/roles/etcd/defaults/main.yml | 2 - .../project/roles/etcd/handlers/main.yml | 31 +- .../project/roles/etcd/tasks/check_certs.yml | 10 +- .../project/roles/etcd/tasks/configure.yml | 40 +- .../roles/etcd/tasks/gen_certs_script.yml | 43 +- .../project/roles/etcd/tasks/install_host.yml | 7 +- .../etcd/tasks/join_etcd-events_member.yml | 2 +- .../roles/etcd/tasks/join_etcd_member.yml | 2 +- kubespray/project/roles/etcd/tasks/main.yml | 42 +- .../roles/etcd/tasks/refresh_config.yml | 8 +- .../roles/etcd/templates/etcd-events.env.j2 | 4 +- .../project/roles/etcd/templates/etcd.env.j2 | 6 +- .../roles/etcd/templates/openssl.conf.j2 | 11 +- kubespray/project/roles/etcd/vars/main.yml | 4 +- .../roles/etcdctl_etcdutl/tasks/main.yml | 2 +- .../roles/helm-apps/meta/argument_specs.yml | 6 + .../kubernetes-apps/ansible/defaults/main.yml | 8 +- .../kubernetes-apps/ansible/tasks/coredns.yml | 50 - .../ansible/tasks/dashboard.yml | 21 - .../ansible/tasks/etcd_metrics.yml | 22 - .../kubernetes-apps/ansible/tasks/main.yml | 116 +- .../ansible/tasks/netchecker.yml | 47 - .../ansible/tasks/nodelocaldns.yml | 79 - .../ansible/templates/coredns-config.yml.j2 | 6 +- .../ansible/templates/dashboard.yml.j2 | 24 +- .../ansible/templates/dns-autoscaler.yml.j2 | 16 +- .../templates/nodelocaldns-config.yml.j2 | 14 +- .../templates/nodelocaldns-daemonset.yml.j2 | 5 +- .../nodelocaldns-second-daemonset.yml.j2 | 4 + .../kubernetes-apps/ansible/vars/main.yml | 22 + .../kubernetes-apps/argocd/defaults/main.yml | 4 +- .../cloud_controller/oci/defaults/main.yml | 6 - .../oci/tasks/credentials-check.yml | 67 - .../cloud_controller/oci/tasks/main.yml | 35 - .../controller-manager-config.yml.j2 | 89 - .../cluster_roles/tasks/main.yml | 7 - .../cluster_roles/tasks/oci.yml | 19 - .../roles/kubernetes-apps/csi_driver/OWNERS | 6 - .../csi_driver/cinder/tasks/main.yml | 2 +- .../templates/upcloud-csi-controller.yml.j2 | 2 +- .../upcloud/templates/upcloud-csi-node.yml.j2 | 2 +- .../csi_driver/vsphere/defaults/main.yml | 6 +- .../vsphere-csi-controller-config.yml.j2 | 2 - .../vsphere-csi-controller-deployment.yml.j2 | 4 +- .../vsphere-csi-controller-rbac.yml.j2 | 2 - .../vsphere/templates/vsphere-csi-node.yml.j2 | 2 +- .../roles/kubernetes-apps/defaults/main.yml | 2 + .../huaweicloud/defaults/main.yml | 12 +- .../external_cloud_controller/meta/main.yml | 16 +- .../oci/defaults/main.yml | 25 + .../oci/tasks/main.yml | 53 + .../external-oci-cloud-config-secret.yml.j2 | 10 + .../external-oci-cloud-config.yml.j2 | 45 + ...-oci-cloud-controller-manager-rbac.yml.j2} | 42 + ...ernal-oci-cloud-controller-manager.yml.j2} | 24 +- .../openstack/OWNERS | 6 - .../openstack/defaults/main.yml | 2 +- .../vsphere/defaults/main.yml | 2 +- ...vsphere-cloud-controller-manager-ds.yml.j2 | 2 +- .../cephfs_provisioner/defaults/main.yml | 10 - .../cephfs_provisioner/tasks/main.yml | 71 - .../templates/00-namespace.yml.j2 | 7 - .../clusterrole-cephfs-provisioner.yml.j2 | 22 - ...usterrolebinding-cephfs-provisioner.yml.j2 | 13 - .../deploy-cephfs-provisioner.yml.j2 | 34 - .../templates/role-cephfs-provisioner.yml.j2 | 13 - .../rolebinding-cephfs-provisioner.yml.j2 | 14 - .../templates/sa-cephfs-provisioner.yml.j2 | 6 - .../templates/sc-cephfs-provisioner.yml.j2 | 15 - .../secret-cephfs-provisioner.yml.j2 | 9 - .../external_provisioner/meta/main.yml | 13 - .../rbd_provisioner/defaults/main.yml | 17 - .../rbd_provisioner/tasks/main.yml | 71 - .../templates/00-namespace.yml.j2 | 7 - .../clusterrole-rbd-provisioner.yml.j2 | 26 - .../clusterrolebinding-rbd-provisioner.yml.j2 | 13 - .../templates/deploy-rbd-provisioner.yml.j2 | 40 - .../templates/role-rbd-provisioner.yml.j2 | 13 - .../rolebinding-rbd-provisioner.yml.j2 | 14 - .../templates/sa-rbd-provisioner.yml.j2 | 6 - .../templates/sc-rbd-provisioner.yml.j2 | 19 - .../templates/secret-rbd-provisioner.yml.j2 | 18 - .../gateway_api/defaults/main.yml | 9 +- .../gateway_api/tasks/main.yml | 18 +- .../templates/experimental-install.yaml.j2 | 18317 ---------------- .../templates/standard-install.yaml.j2 | 13478 ------------ .../alb_ingress_controller/OWNERS | 6 - .../templates/cert-manager.crds.yml.j2 | 4967 ++++- .../templates/cert-manager.yml.j2 | 38 +- .../ingress_nginx/defaults/main.yml | 2 + .../admission-webhook-configuration.yml.j2 | 1 + .../ds-ingress-nginx-controller.yml.j2 | 42 +- .../templates/svc-ingress-nginx.yml.j2 | 20 + .../kubernetes-apps/krew/defaults/main.yml | 5 - .../roles/kubernetes-apps/krew/tasks/krew.yml | 38 - .../roles/kubernetes-apps/krew/tasks/main.yml | 10 - .../kubernetes-apps/krew/templates/krew.j2 | 7 - .../krew/templates/krew.yml.j2 | 100 - .../kubelet-csr-approver/meta/main.yml | 3 +- .../roles/kubernetes-apps/meta/main.yml | 22 +- .../roles/kubernetes-apps/metallb/OWNERS | 5 - .../metallb/templates/metallb.yaml.j2 | 4 +- .../metrics_server/defaults/main.yml | 6 +- .../metrics_server/tasks/main.yml | 5 - .../metrics-server-deployment.yaml.j2 | 20 +- .../network_plugin/kube-router/OWNERS | 6 - .../network_plugin/multus/tasks/main.yml | 2 +- .../persistent_volumes/aws-ebs-csi/OWNERS | 5 - .../persistent_volumes/meta/main.yml | 7 - .../openstack/defaults/main.yml | 7 - .../openstack/tasks/main.yml | 20 - .../templates/openstack-storage-class.yml.j2 | 27 - .../templates/calico-kube-controllers.yml.j2 | 6 + .../calico/templates/calico-kube-cr.yml.j2 | 15 +- .../roles/kubernetes-apps/vars/main.yml | 2 + .../roles/kubernetes/client/tasks/main.yml | 2 +- .../control-plane/defaults/main/etcd.yml | 2 - .../defaults/main/kube-scheduler.yml | 2 +- .../control-plane/defaults/main/main.yml | 42 +- .../control-plane/handlers/main.yml | 60 +- .../kubernetes/control-plane/meta/main.yml | 5 +- .../control-plane/tasks/check-api.yml | 10 + .../control-plane/tasks/encrypt-at-rest.yml | 2 +- .../tasks/kubeadm-fix-apiserver.yml | 6 +- .../control-plane/tasks/kubeadm-secondary.yml | 17 +- .../control-plane/tasks/kubeadm-setup.yml | 97 +- .../control-plane/tasks/kubeadm-upgrade.yml | 97 +- .../kubelet-fix-client-cert-rotation.yml | 4 +- .../kubernetes/control-plane/tasks/main.yml | 25 +- .../control-plane/tasks/pre-upgrade.yml | 8 +- .../templates/kubeadm-config.v1beta3.yaml.j2 | 92 +- .../templates/kubeadm-config.v1beta4.yaml.j2 | 593 + ...3.yaml.j2 => kubeadm-controlplane.yaml.j2} | 20 +- .../templates/resourcequota.yaml.j2 | 8 + .../kubernetes/control-plane/vars/main.yaml | 8 +- .../kubernetes/kubeadm/defaults/main.yml | 7 - .../roles/kubernetes/kubeadm/meta/main.yml | 3 + .../kubeadm/tasks/kubeadm_etcd_node.yml | 5 +- .../roles/kubernetes/kubeadm/tasks/main.yml | 94 +- ...conf.v1beta3.j2 => kubeadm-client.conf.j2} | 24 +- .../kubeadm_common/defaults/main.yml | 23 + .../kubernetes/kubeadm_common/tasks/main.yml | 17 + .../roles/kubernetes/node/defaults/main.yml | 118 +- .../azure-credential-check.yml | 82 - .../openstack-credential-check.yml | 34 - .../vsphere-credential-check.yml | 22 - .../roles/kubernetes/node/tasks/install.yml | 2 +- .../roles/kubernetes/node/tasks/main.yml | 63 +- .../kubernetes/node/tasks/pre_upgrade.yml | 48 - .../cloud-configs/aws-cloud-config.j2 | 11 - .../cloud-configs/azure-cloud-config.j2 | 26 - .../cloud-configs/gce-cloud-config.j2 | 2 - .../cloud-configs/openstack-cloud-config.j2 | 54 - .../cloud-configs/vsphere-cloud-config.j2 | 36 - .../templates/kubelet-config.v1beta1.yaml.j2 | 70 +- .../node/templates/kubelet.env.v1beta1.j2 | 7 +- .../templates/loadbalancer/haproxy.cfg.j2 | 6 +- .../node/templates/loadbalancer/nginx.conf.j2 | 6 +- .../templates/manifests/kube-vip.manifest.j2 | 5 + .../node/templates/node-kubeconfig.yaml.j2 | 2 +- .../kubernetes/preinstall/defaults/main.yml | 35 +- .../preinstall/files/pkgs-schema.json | 80 - .../kubernetes/preinstall/handlers/main.yml | 14 +- .../preinstall/tasks/0020-set_facts.yml | 91 +- .../preinstall/tasks/0040-verify-settings.yml | 297 +- .../tasks/0050-create_directories.yml | 30 +- .../preinstall/tasks/0060-resolvconf.yml | 7 +- .../tasks/0063-networkmanager-dns.yml | 13 +- .../tasks/0080-system-configurations.yml | 13 +- .../tasks/0081-ntp-configurations.yml | 16 +- .../preinstall/tasks/0090-etchosts.yml | 15 +- .../preinstall/tasks/0100-dhclient-hooks.yml | 11 +- .../tasks/0110-dhclient-hooks-undo.yml | 2 +- .../kubernetes/preinstall/tasks/main.yml | 28 +- .../preinstall/templates/resolved.conf.j2 | 10 +- .../roles/kubernetes/preinstall/vars/main.yml | 123 +- .../kubernetes/tokens/files/kube-gen-token.sh | 34 - .../kubernetes/tokens/tasks/check-tokens.yml | 41 - .../kubernetes/tokens/tasks/gen_tokens.yml | 63 - .../roles/kubernetes/tokens/tasks/main.yml | 21 - .../defaults/main/checksums.yml | 1228 -- .../kubespray-defaults/tasks/fallback_ips.yml | 35 - .../roles/kubespray-defaults/tasks/main.yaml | 28 - .../roles/kubespray-defaults/tasks/main.yml | 10 + .../roles/kubespray-defaults/vars/main.yml | 9 - .../defaults/main/download.yml | 493 +- .../defaults/main/main.yml | 215 +- .../vars/main/checksums.yml | 1358 ++ .../kubespray_defaults/vars/main/main.yml | 29 + .../project/roles/network_facts/meta/main.yml | 3 + .../roles/network_facts/tasks/main.yaml | 58 + .../tasks/no_proxy.yml | 10 +- .../network_plugin/calico/tasks/check.yml | 61 +- .../network_plugin/calico/tasks/install.yml | 41 +- .../calico/tasks/peer_with_calico_rr.yml | 2 +- .../calico/tasks/peer_with_router.yml | 13 +- .../roles/network_plugin/calico/tasks/pre.yml | 11 - .../calico/templates/calico-apiserver.yml.j2 | 5 +- .../calico/templates/calico-config.yml.j2 | 12 +- .../calico/templates/calico-cr.yml.j2 | 14 + .../calico/templates/calico-node.yml.j2 | 117 +- .../calico/templates/calico-typha.yml.j2 | 8 +- .../calico_defaults/defaults/main.yml | 4 +- .../network_plugin/cilium/defaults/main.yml | 122 +- .../network_plugin/cilium/tasks/apply.yml | 238 +- .../network_plugin/cilium/tasks/check.yml | 8 +- .../network_plugin/cilium/tasks/install.yml | 60 +- .../templates/cilium-operator/cr.yml.j2 | 188 - .../templates/cilium-operator/crb.yml.j2 | 13 - .../templates/cilium-operator/deploy.yml.j2 | 170 - .../templates/cilium-operator/sa.yml.j2 | 6 - .../cilium/cilium-bgp-advertisement.yml.j2 | 12 + .../cilium/cilium-bgp-cluster-config.yml.j2 | 9 + .../cilium-bgp-node-config-override.yml.j2 | 9 + .../cilium/cilium-bgp-peer-config.yml.j2 | 9 + .../cilium/cilium-bgp-peering-policy.yml.j2 | 9 + .../cilium/cilium-loadbalancer-ip-pool.yml.j2 | 16 + .../cilium/templates/cilium/config.yml.j2 | 282 - .../cilium/templates/cilium/cr.yml.j2 | 155 - .../cilium/templates/cilium/crb.yml.j2 | 13 - .../cilium/templates/cilium/ds.yml.j2 | 446 - .../cilium/templates/cilium/sa.yml.j2 | 6 - .../cilium/templates/cilium/secret.yml.j2 | 9 - .../cilium/templates/hubble/config.yml.j2 | 71 - .../cilium/templates/hubble/cr.yml.j2 | 106 - .../cilium/templates/hubble/crb.yml.j2 | 44 - .../cilium/templates/hubble/cronjob.yml.j2 | 38 - .../cilium/templates/hubble/deploy.yml.j2 | 197 - .../cilium/templates/hubble/job.yml.j2 | 34 - .../cilium/templates/hubble/sa.yml.j2 | 23 - .../cilium/templates/hubble/service.yml.j2 | 104 - .../cilium/templates/values.yaml.j2 | 164 + .../network_plugin/flannel/defaults/main.yml | 2 +- .../flannel/templates/cni-flannel.yml.j2 | 6 +- .../roles/network_plugin/kube-ovn/OWNERS | 4 - .../network_plugin/kube-ovn/defaults/main.yml | 19 +- .../kube-ovn/templates/cni-kube-ovn.yml.j2 | 18 +- .../kube-ovn/templates/cni-ovn.yml.j2 | 6 +- .../roles/network_plugin/kube-router/OWNERS | 6 - .../kube-router/tasks/annotate.yml | 6 +- .../kube-router/templates/kubeconfig.yml.j2 | 2 +- .../roles/network_plugin/macvlan/OWNERS | 6 - .../roles/network_plugin/meta/main.yml | 3 +- .../network_plugin/multus/defaults/main.yml | 2 +- .../multus/templates/multus-daemonset.yml.j2 | 25 +- .../network_plugin/weave/defaults/main.yml | 2 +- .../roles/recover_control_plane/OWNERS | 8 - .../control-plane/tasks/main.yml | 4 +- .../post-recover/tasks/main.yml | 4 +- .../remove-node/post-remove/tasks/main.yml | 4 +- .../remove-node/pre-remove/tasks/main.yml | 47 +- .../remove-etcd-node/tasks/main.yml | 73 +- .../pre_remove}/defaults/main.yml | 0 .../remove_node/pre_remove/tasks/main.yml | 43 + .../project/roles/reset/defaults/main.yml | 16 - kubespray/project/roles/reset/tasks/main.yml | 32 +- .../roles/system_packages/defaults/main.yml | 4 + .../tasks/main.yml} | 42 +- .../roles/system_packages/vars/main.yml | 102 + .../roles/validate_inventory/meta/main.yml | 3 + .../roles/validate_inventory/tasks/main.yml | 270 + kubespray/project/scale.yml | 33 +- kubespray/project/upgrade_cluster.yml | 27 +- requirements.txt | 12 +- 366 files changed, 9939 insertions(+), 40388 deletions(-) create mode 100644 .ansible-lint create mode 100644 .ansible-lint-ignore create mode 100644 Makefile delete mode 100644 kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/defaults/main.yml (79%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/files/bootstrap.sh (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/handlers/main.yml (100%) create mode 100644 kubespray/project/roles/bootstrap_os/meta/main.yml rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/molecule/default/converge.yml (61%) create mode 100644 kubespray/project/roles/bootstrap_os/molecule/default/molecule.yml rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/molecule/default/tests/test_default.py (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/amzn.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/centos.yml (90%) rename kubespray/project/roles/{bootstrap-os/tasks/clearlinux.yml => bootstrap_os/tasks/clear-linux-os.yml} (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/debian.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/fedora-coreos.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/fedora.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/flatcar.yml (87%) create mode 100644 kubespray/project/roles/bootstrap_os/tasks/main.yml rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/openEuler.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/opensuse-leap.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/opensuse-tumbleweed.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/opensuse.yml (100%) rename kubespray/project/roles/{bootstrap-os/tasks/redhat.yml => bootstrap_os/tasks/rhel.yml} (89%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/tasks/ubuntu.yml (77%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/vars/fedora-coreos.yml (100%) rename kubespray/project/roles/{bootstrap-os => bootstrap_os}/vars/flatcar.yml (100%) create mode 100644 kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2 delete mode 100644 kubespray/project/roles/container-engine/containerd/vars/debian.yml delete mode 100644 kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml create mode 100644 kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml delete mode 100644 kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml create mode 100644 kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml delete mode 100644 kubespray/project/roles/container-engine/docker/vars/redhat-7.yml delete mode 100644 kubespray/project/roles/container-engine/kata-containers/OWNERS delete mode 100644 kubespray/project/roles/kubernetes-apps/ansible/tasks/coredns.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/ansible/tasks/dashboard.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/ansible/tasks/etcd_metrics.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/ansible/tasks/netchecker.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/ansible/tasks/nodelocaldns.yml create mode 100644 kubespray/project/roles/kubernetes-apps/ansible/vars/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/cloud_controller/oci/defaults/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/credentials-check.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/controller-manager-config.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/oci.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/csi_driver/OWNERS create mode 100644 kubespray/project/roles/kubernetes-apps/defaults/main.yml create mode 100644 kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/defaults/main.yml create mode 100644 kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml create mode 100644 kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config-secret.yml.j2 create mode 100644 kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config.yml.j2 rename kubespray/project/roles/kubernetes-apps/{cluster_roles/files/oci-rbac.yml => external_cloud_controller/oci/templates/external-oci-cloud-controller-manager-rbac.yml.j2} (74%) rename kubespray/project/roles/kubernetes-apps/{cloud_controller/oci/templates/oci-cloud-provider.yml.j2 => external_cloud_controller/oci/templates/external-oci-cloud-controller-manager.yml.j2} (73%) delete mode 100644 kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/OWNERS delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/defaults/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/tasks/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/00-namespace.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrole-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrolebinding-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/deploy-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/role-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/rolebinding-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sa-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sc-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/secret-cephfs-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/defaults/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/tasks/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/00-namespace.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrole-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrolebinding-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/deploy-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/role-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/rolebinding-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sa-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sc-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/secret-rbd-provisioner.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/gateway_api/templates/experimental-install.yaml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/gateway_api/templates/standard-install.yaml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS delete mode 100644 kubespray/project/roles/kubernetes-apps/krew/defaults/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/krew/tasks/krew.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/krew/tasks/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/krew/templates/krew.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/krew/templates/krew.yml.j2 delete mode 100644 kubespray/project/roles/kubernetes-apps/metallb/OWNERS delete mode 100644 kubespray/project/roles/kubernetes-apps/network_plugin/kube-router/OWNERS delete mode 100644 kubespray/project/roles/kubernetes-apps/persistent_volumes/aws-ebs-csi/OWNERS delete mode 100644 kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/defaults/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/tasks/main.yml delete mode 100644 kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/templates/openstack-storage-class.yml.j2 create mode 100644 kubespray/project/roles/kubernetes-apps/vars/main.yml create mode 100644 kubespray/project/roles/kubernetes/control-plane/tasks/check-api.yml create mode 100644 kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2 rename kubespray/project/roles/kubernetes/control-plane/templates/{kubeadm-controlplane.v1beta3.yaml.j2 => kubeadm-controlplane.yaml.j2} (64%) create mode 100644 kubespray/project/roles/kubernetes/control-plane/templates/resourcequota.yaml.j2 create mode 100644 kubespray/project/roles/kubernetes/kubeadm/meta/main.yml rename kubespray/project/roles/kubernetes/kubeadm/templates/{kubeadm-client.conf.v1beta3.j2 => kubeadm-client.conf.j2} (57%) create mode 100644 kubespray/project/roles/kubernetes/kubeadm_common/defaults/main.yml create mode 100644 kubespray/project/roles/kubernetes/kubeadm_common/tasks/main.yml delete mode 100644 kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/azure-credential-check.yml delete mode 100644 kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/openstack-credential-check.yml delete mode 100644 kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/vsphere-credential-check.yml delete mode 100644 kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml delete mode 100644 kubespray/project/roles/kubernetes/node/templates/cloud-configs/aws-cloud-config.j2 delete mode 100644 kubespray/project/roles/kubernetes/node/templates/cloud-configs/azure-cloud-config.j2 delete mode 100644 kubespray/project/roles/kubernetes/node/templates/cloud-configs/gce-cloud-config.j2 delete mode 100644 kubespray/project/roles/kubernetes/node/templates/cloud-configs/openstack-cloud-config.j2 delete mode 100644 kubespray/project/roles/kubernetes/node/templates/cloud-configs/vsphere-cloud-config.j2 delete mode 100644 kubespray/project/roles/kubernetes/preinstall/files/pkgs-schema.json delete mode 100644 kubespray/project/roles/kubernetes/tokens/files/kube-gen-token.sh delete mode 100644 kubespray/project/roles/kubernetes/tokens/tasks/check-tokens.yml delete mode 100644 kubespray/project/roles/kubernetes/tokens/tasks/gen_tokens.yml delete mode 100644 kubespray/project/roles/kubernetes/tokens/tasks/main.yml delete mode 100644 kubespray/project/roles/kubespray-defaults/defaults/main/checksums.yml delete mode 100644 kubespray/project/roles/kubespray-defaults/tasks/fallback_ips.yml delete mode 100644 kubespray/project/roles/kubespray-defaults/tasks/main.yaml create mode 100644 kubespray/project/roles/kubespray-defaults/tasks/main.yml delete mode 100644 kubespray/project/roles/kubespray-defaults/vars/main.yml rename kubespray/project/roles/{kubespray-defaults => kubespray_defaults}/defaults/main/download.yml (71%) rename kubespray/project/roles/{kubespray-defaults => kubespray_defaults}/defaults/main/main.yml (70%) create mode 100644 kubespray/project/roles/kubespray_defaults/vars/main/checksums.yml create mode 100644 kubespray/project/roles/kubespray_defaults/vars/main/main.yml create mode 100644 kubespray/project/roles/network_facts/meta/main.yml create mode 100644 kubespray/project/roles/network_facts/tasks/main.yaml rename kubespray/project/roles/{kubespray-defaults => network_facts}/tasks/no_proxy.yml (72%) delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/cr.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/crb.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/deploy.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/sa.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-cluster-config.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-node-config-override.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peer-config.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peering-policy.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-loadbalancer-ip-pool.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/config.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/cr.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/crb.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/ds.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/sa.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/cilium/secret.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/config.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/cr.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/crb.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/cronjob.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/deploy.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/job.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/sa.yml.j2 delete mode 100644 kubespray/project/roles/network_plugin/cilium/templates/hubble/service.yml.j2 create mode 100644 kubespray/project/roles/network_plugin/cilium/templates/values.yaml.j2 delete mode 100644 kubespray/project/roles/network_plugin/kube-ovn/OWNERS delete mode 100644 kubespray/project/roles/network_plugin/kube-router/OWNERS delete mode 100644 kubespray/project/roles/network_plugin/macvlan/OWNERS delete mode 100644 kubespray/project/roles/recover_control_plane/OWNERS rename kubespray/project/roles/{remove-node/pre-remove => remove_node/pre_remove}/defaults/main.yml (100%) create mode 100644 kubespray/project/roles/remove_node/pre_remove/tasks/main.yml create mode 100644 kubespray/project/roles/system_packages/defaults/main.yml rename kubespray/project/roles/{kubernetes/preinstall/tasks/0070-system-packages.yml => system_packages/tasks/main.yml} (57%) create mode 100644 kubespray/project/roles/system_packages/vars/main.yml create mode 100644 kubespray/project/roles/validate_inventory/meta/main.yml create mode 100644 kubespray/project/roles/validate_inventory/tasks/main.yml diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..8f2c5e8 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,45 @@ +--- +parseable: true +skip_list: + # see https://docs.ansible.com/ansible-lint/rules/default_rules.html for a list of all default rules + + # DO NOT add any other rules to this skip_list, instead use local `# noqa` with a comment explaining WHY it is necessary + + # These rules are intentionally skipped: + # + # [role-name] "meta/main.yml" Role name role-name does not match ``^+$`` pattern + # Meta roles in Kubespray don't need proper names + # (Disabled in June 2021) + - 'role-name' + + # [var-naming] "defaults/main.yml" File defines variable 'apiVersion' that violates variable naming standards + # In Kubespray we use variables that use camelCase to match their k8s counterparts + # (Disabled in June 2021) + - 'var-naming' + + # [fqcn-builtins] + # Roles in kubespray don't need fully qualified collection names + # (Disabled in Feb 2023) + - 'fqcn-builtins' + + # We use template in names + - 'name[template]' + + # No changed-when on commands + # (Disabled in June 2023 after ansible upgrade; FIXME) + - 'no-changed-when' + + # Disable run-once check with free strategy + # (Disabled in June 2023 after ansible upgrade; FIXME) + - 'run-once[task]' +exclude_paths: + # Generated files + - tests/files/custom_cni/cilium.yaml + - venv + - .github + - .ansible + - .cache + - .gitlab-ci.yml + - .gitlab-ci +mock_modules: + - gluster.gluster.gluster_volume diff --git a/.ansible-lint-ignore b/.ansible-lint-ignore new file mode 100644 index 0000000..730b579 --- /dev/null +++ b/.ansible-lint-ignore @@ -0,0 +1,8 @@ +# This file contains ignores rule violations for ansible-lint +inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml jinja[spacing] +roles/kubernetes/control-plane/defaults/main/kube-proxy.yml jinja[spacing] +roles/kubernetes/control-plane/defaults/main/main.yml jinja[spacing] +roles/kubernetes/kubeadm/defaults/main.yml jinja[spacing] +roles/kubernetes/node/defaults/main.yml jinja[spacing] +roles/kubernetes/preinstall/defaults/main.yml jinja[spacing] +roles/kubespray-defaults/defaults/main/main.yml jinja[spacing] diff --git a/.gitignore b/.gitignore index b8e49b4..8da259f 100644 --- a/.gitignore +++ b/.gitignore @@ -6,4 +6,8 @@ vault-keys.json config.yaml temp -*id_rsa* \ No newline at end of file +*id_rsa* +.venv +.ropeproject +*__pycache__ +bin diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..d4ed32a --- /dev/null +++ b/Makefile @@ -0,0 +1,18 @@ +BINNAME := kube-forge +BINDIR := $(CURDIR)/bin +TARGETS := darwin/amd64 darwin/arm64 linux/amd64 linux/arm linux/arm64 windows/amd64 windows/arm64 + +.PHONY: run +run: + @'$(BINDIR)/'$(BINNAME) + + +.PHONY: build +build: + @go build -v -trimpath -ldflags "-s -w $(ADDITIONAL_LLD_FLAGS)" -o '$(BINDIR)/'$(BINNAME) ./cmd/main/main.go + +.PHONY: clean +clean: + @rm -r ${BINDIR} + +.DEFAULT_GOAL := build diff --git a/ansible.cfg b/ansible.cfg index 3687ad0..e795237 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -11,7 +11,8 @@ gathering = smart fact_caching = jsonfile fact_caching_connection = /tmp fact_caching_timeout = 86400 -stdout_callback = dense +timeout = 300 +stdout_callback = default display_skipped_hosts = no library = ./library callbacks_enabled = profile_tasks,ara_default diff --git a/config.sample.yaml b/config.sample.yaml index 10e86b0..49bffaf 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -17,7 +17,7 @@ hosts: roles: [node] orchestrator: - version: v1.30.3 + version: v1.32 cluster_name: cluster.local kubelet_dir: "/app/k8s/kubelet" proxy_mode: "ipvs" # iptables, ipvs diff --git a/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl index 4765798..453b4d4 100644 --- a/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl +++ b/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl @@ -44,14 +44,6 @@ containerd_state_dir: {{ .Orchestrator.ContainerEngine.StateDir }} # containerd_metrics_grpc_histogram: false -# Registries defined within containerd. -# containerd_registries_mirrors: -# - prefix: docker.io -# mirrors: -# - host: https://registry-1.docker.io -# capabilities: ["pull", "resolve"] -# skip_verify: false - # containerd_max_container_log_line_size: -1 # containerd_registry_auth: diff --git a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl index f3a9d74..ab66ba8 100644 --- a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl +++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl @@ -448,10 +448,7 @@ auto_renew_certificates: {{ .Orchestrator.AutoRenewCertificates }} # auto_renew_certificates_systemd_calendar: {{ `"Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"` }} # kubeadm patches path -kubeadm_patches: - enabled: false - source_dir: {{ `"{{ inventory_dir }}/patches"` }} - dest_dir: {{ `"{{ kube_config_dir }}/patches"` }} +kubeadm_patches: [] {{- if not (eq .Orchestrator.KubeletDir "/var/lib/kubelet") }} ## Kubelet additional settings diff --git a/internal/resources/templates/kubespray/inventory/hosts.tmpl b/internal/resources/templates/kubespray/inventory/hosts.tmpl index d210f36..510c08d 100644 --- a/internal/resources/templates/kubespray/inventory/hosts.tmpl +++ b/internal/resources/templates/kubespray/inventory/hosts.tmpl @@ -44,10 +44,6 @@ {{- end }} {{- end }} -[k8s_cluster:children] -kube_control_plane -kube_node - [all:vars] ansible_connection=ssh {{- if not (eq .Credentials.User "") }} diff --git a/kubespray/inventory/group_vars/all/containerd.yml b/kubespray/inventory/group_vars/all/containerd.yml index dce8fae..b13bde7 100644 --- a/kubespray/inventory/group_vars/all/containerd.yml +++ b/kubespray/inventory/group_vars/all/containerd.yml @@ -45,12 +45,15 @@ containerd_state_dir: /app/containerd-state # containerd_metrics_grpc_histogram: false # Registries defined within containerd. -# containerd_registries_mirrors: -# - prefix: docker.io -# mirrors: -# - host: https://registry-1.docker.io -# capabilities: ["pull", "resolve"] -# skip_verify: false +containerd_registries_mirrors: + - prefix: docker.io + mirrors: + - host: https://mirror.gcr.io + capabilities: ["pull", "resolve"] + skip_verify: false + - host: https://quay.io + capabilities: ["pull", "resolve"] + skip_verify: false # containerd_max_container_log_line_size: -1 diff --git a/kubespray/inventory/group_vars/k8s_cluster/addons.yml b/kubespray/inventory/group_vars/k8s_cluster/addons.yml index 1cd7750..c9dd25a 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/addons.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/addons.yml @@ -12,7 +12,7 @@ local_path_provisioner_enabled: true # local_path_provisioner_namespace: "local-path-storage" local_path_provisioner_storage_class: local-path local_path_provisioner_reclaim_policy: Delete -local_path_provisioner_claim_root: /opt/local-path-provisioner/ +local_path_provisioner_claim_root: /app/local-path-provisioner # local_path_provisioner_debug: false # local_path_provisioner_image_repo: "rancher/local-path-provisioner" # local_path_provisioner_image_tag: "v0.0.23" diff --git a/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml b/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml index 7b25fed..b738a35 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml @@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens" kube_api_anonymous_auth: true ## Change this to use another Kubernetes version, e.g. a current beta release -kube_version: v1.29.0 +kube_version: 1.32.4 # Where the binaries will be downloaded. # Note: ensure that you've enough disk space (about 1G) @@ -226,15 +226,6 @@ dns_domain: "{{ cluster_name }}" ## docker for docker, crio for cri-o and containerd for containerd. ## Default: containerd container_manager: containerd -containerd_registries_mirrors: - - prefix: docker.io - mirrors: - - host: https://mirror.gcr.io - capabilities: ["pull", "resolve"] - skip_verify: false - - host: https://quay.io - capabilities: ["pull", "resolve"] - skip_verify: false ## CRI-O registry mirrors setup crio_registries: @@ -401,7 +392,7 @@ auto_renew_certificates: true # auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00" # kubeadm patches path -kubeadm_patches: - enabled: false - source_dir: "{{ inventory_dir }}/patches" - dest_dir: "{{ kube_config_dir }}/patches" \ No newline at end of file +kubeadm_patches: [] +## Kubelet additional settings +kubelet_custom_flags: + - "--root-dir=/app/k8s/kubelet" \ No newline at end of file diff --git a/kubespray/inventory/hosts b/kubespray/inventory/hosts index e861a80..5ead582 100644 --- a/kubespray/inventory/hosts +++ b/kubespray/inventory/hosts @@ -1,39 +1,17 @@ -t1-disk-lt-k8s-master-01 ansible_host=10.100.20.43 ip=10.100.20.43 -t1-disk-lt-k8s-master-02 ansible_host=10.100.20.38 ip=10.100.20.38 -t1-disk-lt-k8s-master-03 ansible_host=10.100.20.42 ip=10.100.20.42 -t1-disk-lt-k8s-slave-01 ansible_host=10.100.20.40 ip=10.100.20.40 -t1-disk-lt-k8s-slave-02 ansible_host=10.100.20.41 ip=10.100.20.41 -t1-disk-lt-k8s-slave-03 ansible_host=10.100.20.39 ip=10.100.20.39 -t1-disk-lt-k8s-slave-04 ansible_host=10.100.20.45 ip=10.100.20.45 -t1-disk-lt-k8s-slave-05 ansible_host=10.100.20.44 ip=10.100.20.44 -t1-disk-lt-k8s-slave-06 ansible_host=10.100.20.50 ip=10.100.20.50 -t1-disk-lt-k8s-slave-07 ansible_host=10.100.20.51 ip=10.100.20.51 +k8s-master-1 ansible_host=172.16.1.136 ip=172.16.1.136 +k8s-worker-1 ansible_host=172.16.1.135 ip=172.16.1.135 [kube_control_plane] -t1-disk-lt-k8s-master-01 -t1-disk-lt-k8s-master-02 -t1-disk-lt-k8s-master-03 +k8s-master-1 [etcd] -t1-disk-lt-k8s-master-01 -t1-disk-lt-k8s-master-02 -t1-disk-lt-k8s-master-03 +k8s-master-1 [kube_node] -t1-disk-lt-k8s-slave-01 -t1-disk-lt-k8s-slave-02 -t1-disk-lt-k8s-slave-03 -t1-disk-lt-k8s-slave-04 -t1-disk-lt-k8s-slave-05 -t1-disk-lt-k8s-slave-06 -t1-disk-lt-k8s-slave-07 - -[k8s_cluster:children] -kube_control_plane -kube_node +k8s-worker-1 [all:vars] ansible_connection=ssh -ansible_user=sre-admin -ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa_bastion_ift +ansible_user=georgest +ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa diff --git a/kubespray/project/boilerplate.yml b/kubespray/project/boilerplate.yml index eafa9b4..b9dce71 100644 --- a/kubespray/project/boilerplate.yml +++ b/kubespray/project/boilerplate.yml @@ -2,57 +2,45 @@ - name: Check ansible version import_playbook: ansible_version.yml -# These are inventory compatibility tasks to ensure we keep compatibility with old style group names +# These are inventory compatibility tasks with two purposes: +# - to ensure we keep compatibility with old style group names +# - to reduce inventory boilerplate (defining parent groups / empty groups) -- name: Add kube-master nodes to kube_control_plane - hosts: kube-master +- name: Define groups for legacy less structured inventories + hosts: all gather_facts: false tags: always tasks: - - name: Add nodes to kube_control_plane group + - name: Match needed groups by their old names or definition + vars: + group_mappings: + kube_control_plane: + - kube-master + kube_node: + - kube-node + calico_rr: + - calico-rr + no_floating: + - no-floating + k8s_cluster: + - kube_node + - kube_control_plane + - calico_rr group_by: - key: 'kube_control_plane' + key: "{{ (group_names | intersect(item.value) | length > 0) | ternary(item.key, '_all') }}" + loop: "{{ group_mappings | dict2items }}" -- name: Add kube-node nodes to kube_node - hosts: kube-node +- name: Check inventory settings + hosts: all gather_facts: false tags: always - tasks: - - name: Add nodes to kube_node group - group_by: - key: 'kube_node' - -- name: Add k8s-cluster nodes to k8s_cluster - hosts: k8s-cluster - gather_facts: false - tags: always - tasks: - - name: Add nodes to k8s_cluster group - group_by: - key: 'k8s_cluster' - -- name: Add calico-rr nodes to calico_rr - hosts: calico-rr - gather_facts: false - tags: always - tasks: - - name: Add nodes to calico_rr group - group_by: - key: 'calico_rr' - -- name: Add no-floating nodes to no_floating - hosts: no-floating - gather_facts: false - tags: always - tasks: - - name: Add nodes to no-floating group - group_by: - key: 'no_floating' + roles: + - validate_inventory - name: Install bastion ssh config hosts: bastion[0] gather_facts: false environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: bastion-ssh-config, tags: ["localhost", "bastion"] } diff --git a/kubespray/project/cluster.yml b/kubespray/project/cluster.yml index ca67a28..bf9bc98 100644 --- a/kubespray/project/cluster.yml +++ b/kubespray/project/cluster.yml @@ -11,12 +11,15 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/preinstall, tags: preinstall } - { role: "container-engine", tags: "container-engine", when: deploy_container_engine } - { role: download, tags: download, when: "not skip_downloads" } - name: Install etcd + vars: + etcd_cluster_setup: true + etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}" import_playbook: install_etcd.yml - name: Install Kubernetes nodes @@ -25,7 +28,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/node, tags: node } - name: Install the control plane @@ -34,7 +37,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/control-plane, tags: master } - { role: kubernetes/client, tags: client } - { role: kubernetes-apps/cluster_roles, tags: cluster-roles } @@ -45,12 +48,16 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/kubeadm, tags: kubeadm} - { role: kubernetes/node-label, tags: node-label } - { role: kubernetes/node-taint, tags: node-taint } + - role: kubernetes-apps/gateway_api + when: gateway_api_enabled + tags: gateway_api + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true - { role: network_plugin, tags: network } - - { role: kubernetes-apps/kubelet-csr-approver, tags: kubelet-csr-approver } - name: Install Calico Route Reflector hosts: calico_rr @@ -58,7 +65,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] } - name: Patch Kubernetes for Windows @@ -67,7 +74,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] } - name: Install Kubernetes apps @@ -76,7 +83,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller } - { role: kubernetes-apps/network_plugin, tags: network } - { role: kubernetes-apps/policy_controller, tags: policy-controller } @@ -90,5 +97,5 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true } diff --git a/kubespray/project/facts.yml b/kubespray/project/facts.yml index d35eea8..9938c19 100644 --- a/kubespray/project/facts.yml +++ b/kubespray/project/facts.yml @@ -5,19 +5,17 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" gather_facts: false environment: "{{ proxy_disable_env }}" - vars: - # Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining - # fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled. - ansible_ssh_pipelining: false roles: - - { role: kubespray-defaults } - - { role: bootstrap-os, tags: bootstrap-os} + - { role: bootstrap_os, tags: bootstrap_os} - name: Gather facts hosts: k8s_cluster:etcd:calico_rr gather_facts: false tags: always tasks: + - name: Gather and compute network facts + import_role: + name: network_facts - name: Gather minimal facts setup: gather_subset: '!all' diff --git a/kubespray/project/install_etcd.yml b/kubespray/project/install_etcd.yml index 1f58511..c403941 100644 --- a/kubespray/project/install_etcd.yml +++ b/kubespray/project/install_etcd.yml @@ -2,7 +2,7 @@ - name: Add worker nodes to the etcd play if needed hosts: kube_node roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } tasks: - name: Check if nodes needs etcd client certs (depends on network_plugin) group_by: @@ -20,10 +20,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - role: etcd tags: etcd - vars: - etcd_cluster_setup: true - etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}" when: etcd_deployment_type != "kubeadm" diff --git a/kubespray/project/recover_control_plane.yml b/kubespray/project/recover_control_plane.yml index 35ed2c2..b380fc1 100644 --- a/kubespray/project/recover_control_plane.yml +++ b/kubespray/project/recover_control_plane.yml @@ -6,7 +6,7 @@ hosts: etcd[0] environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults} + - { role: kubespray_defaults} - role: recover_control_plane/etcd when: etcd_deployment_type != "kubeadm" @@ -14,7 +14,7 @@ hosts: kube_control_plane[0] environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults} + - { role: kubespray_defaults} - { role: recover_control_plane/control-plane } - name: Apply whole cluster install @@ -24,5 +24,5 @@ hosts: kube_control_plane environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults} + - { role: kubespray_defaults} - { role: recover_control_plane/post-recover } diff --git a/kubespray/project/remove_node.yml b/kubespray/project/remove_node.yml index f994dae..7cd53a8 100644 --- a/kubespray/project/remove_node.yml +++ b/kubespray/project/remove_node.yml @@ -1,9 +1,19 @@ --- +- name: Validate nodes for removal + hosts: localhost + tasks: + - name: Assert that nodes are specified for removal + assert: + that: + - node is defined + - node | length > 0 + msg: "No nodes specified for removal. The `node` variable must be set explicitly." + - name: Common tasks for every playbooks import_playbook: boilerplate.yml - name: Confirm node removal - hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}" + hosts: "{{ node | default('this_is_unreachable') }}" gather_facts: false tasks: - name: Confirm Execution @@ -24,20 +34,25 @@ when: reset_nodes | default(True) | bool - name: Reset node - hosts: "{{ node | default('kube_node') }}" + hosts: "{{ node | default('this_is_unreachable') }}" gather_facts: false environment: "{{ proxy_disable_env }}" + pre_tasks: + - name: Gather information about installed services + service_facts: + when: reset_nodes | default(True) | bool roles: - - { role: kubespray-defaults, when: reset_nodes | default(True) | bool } - - { role: remove-node/pre-remove, tags: pre-remove } - - { role: remove-node/remove-etcd-node } + - { role: kubespray_defaults, when: reset_nodes | default(True) | bool } + - { role: remove_node/pre_remove, tags: pre-remove } + - role: remove-node/remove-etcd-node + when: "'etcd' in group_names" - { role: reset, tags: reset, when: reset_nodes | default(True) | bool } -# Currently cannot remove first master or etcd +# Currently cannot remove first control plane node or first etcd node - name: Post node removal - hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}" + hosts: "{{ node | default('this_is_unreachable') }}" gather_facts: false environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults, when: reset_nodes | default(True) | bool } + - { role: kubespray_defaults, when: reset_nodes | default(True) | bool } - { role: remove-node/post-remove, tags: post-remove } diff --git a/kubespray/project/reset.yml b/kubespray/project/reset.yml index 6fa18c0..3a1f7fd 100644 --- a/kubespray/project/reset.yml +++ b/kubespray/project/reset.yml @@ -30,6 +30,6 @@ environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults} + - { role: kubespray_defaults} - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_early: true } - { role: reset, tags: reset } diff --git a/kubespray/project/roles/adduser/molecule/default/molecule.yml b/kubespray/project/roles/adduser/molecule/default/molecule.yml index 0fb4997..a204326 100644 --- a/kubespray/project/roles/adduser/molecule/default/molecule.yml +++ b/kubespray/project/roles/adduser/molecule/default/molecule.yml @@ -2,22 +2,18 @@ role_name_check: 1 dependency: name: galaxy -driver: - name: vagrant - provider: - name: libvirt platforms: - - name: adduser-01 - box: generic/ubuntu2004 - cpus: 1 - memory: 512 - provider_options: - driver: kvm + - name: ubuntu20 + cloud_image: ubuntu-2004 + vm_cpu_cores: 1 + vm_memory: 512 provisioner: name: ansible config_options: defaults: callbacks_enabled: profile_tasks timeout: 120 + playbooks: + create: ../../../../tests/cloud_playbooks/create-kubevirt.yml verifier: name: testinfra diff --git a/kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml b/kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml index 11cf91c..5a51562 100644 --- a/kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml +++ b/kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml @@ -2,17 +2,11 @@ role_name_check: 1 dependency: name: galaxy -driver: - name: vagrant - provider: - name: libvirt platforms: - name: bastion-01 - box: generic/ubuntu2004 - cpus: 1 - memory: 512 - provider_options: - driver: kvm + cloud_image: ubuntu-2004 + vm_cpu_cores: 1 + vm_memory: 512 provisioner: name: ansible config_options: @@ -27,5 +21,7 @@ provisioner: bastion: hosts: bastion-01: + playbooks: + create: ../../../../tests/cloud_playbooks/create-kubevirt.yml verifier: name: testinfra diff --git a/kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml b/kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml deleted file mode 100644 index 9fa29ae..0000000 --- a/kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -role_name_check: 1 -dependency: - name: galaxy -driver: - name: vagrant - provider: - name: libvirt -platforms: - - name: ubuntu20 - box: generic/ubuntu2004 - cpus: 1 - memory: 512 - provider_options: - driver: kvm - - name: ubuntu22 - box: generic/ubuntu2204 - cpus: 1 - memory: 1024 - provider_options: - driver: kvm - - name: almalinux8 - box: almalinux/8 - cpus: 1 - memory: 512 - provider_options: - driver: kvm - - name: debian10 - box: generic/debian10 - cpus: 1 - memory: 512 - provider_options: - driver: kvm -provisioner: - name: ansible - config_options: - defaults: - callbacks_enabled: profile_tasks - timeout: 120 - inventory: - group_vars: - all: - user: - name: foo - comment: My test comment -verifier: - name: testinfra diff --git a/kubespray/project/roles/bootstrap-os/tasks/main.yml b/kubespray/project/roles/bootstrap-os/tasks/main.yml index c16fe1b..f4d5385 100644 --- a/kubespray/project/roles/bootstrap-os/tasks/main.yml +++ b/kubespray/project/roles/bootstrap-os/tasks/main.yml @@ -1,64 +1,10 @@ --- -- name: Fetch /etc/os-release - raw: cat /etc/os-release - register: os_release - changed_when: false - # This command should always run, even in check mode - check_mode: false +- name: Warn for usage of deprecated role + fail: + msg: bootstrap-os is deprecated, switch to bootstrap_os + ignore_errors: true # noqa ignore-errors + run_once: true -- name: Include distro specifics vars and tasks - vars: - os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') | - map('split', '=') | community.general.dict }}" - block: - - name: Include vars - include_vars: "{{ item }}" - tags: - - facts - with_first_found: - - &search - files: - - "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml" - - "{{ os_release_dict['ID'] }}.yml" - paths: - - vars/ - skip: true - - name: Include tasks - include_tasks: "{{ included_tasks_file }}" - with_first_found: - - <<: *search - paths: [] - loop_control: - loop_var: included_tasks_file - - -- name: Create remote_tmp for it is used by another module - file: - path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}" - state: directory - mode: "0700" - -- name: Gather facts - setup: - gather_subset: '!all' - filter: ansible_* - -- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora) - hostname: - name: "{{ inventory_hostname }}" - when: override_system_hostname - -- name: Install ceph-commmon package - package: - name: - - ceph-common - state: present - when: rbd_provisioner_enabled | default(false) - -- name: Ensure bash_completion.d folder exists - file: - name: /etc/bash_completion.d/ - state: directory - owner: root - group: root - mode: "0755" +- name: Compat for direct role import + import_role: + name: bootstrap_os diff --git a/kubespray/project/roles/bootstrap-os/defaults/main.yml b/kubespray/project/roles/bootstrap_os/defaults/main.yml similarity index 79% rename from kubespray/project/roles/bootstrap-os/defaults/main.yml rename to kubespray/project/roles/bootstrap_os/defaults/main.yml index bb7ca1f..526d025 100644 --- a/kubespray/project/roles/bootstrap-os/defaults/main.yml +++ b/kubespray/project/roles/bootstrap_os/defaults/main.yml @@ -2,11 +2,16 @@ ## CentOS/RHEL/AlmaLinux specific variables # Use the fastestmirror yum plugin centos_fastestmirror_enabled: false +# Timeout (in seconds) for checking RHEL subscription status +rh_subscription_check_timeout: 180 ## Flatcar Container Linux specific variables # Disable locksmithd or leave it in its current state coreos_locksmithd_disable: false +# Install epel repo on Centos/RHEL +epel_enabled: false + ## Oracle Linux specific variables # Install public repo on Oracle Linux use_oracle_public_repo: true @@ -14,6 +19,8 @@ use_oracle_public_repo: true ## Ubuntu specific variables # Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu ubuntu_kernel_unattended_upgrades_disabled: false +# Stop unattended-upgrades if it is currently running on Ubuntu +ubuntu_stop_unattended_upgrades: false fedora_coreos_packages: - python @@ -21,6 +28,7 @@ fedora_coreos_packages: - ethtool # required in kubeadm preflight phase for verifying the environment - ipset # required in kubeadm preflight phase for verifying the environment - conntrack-tools # required by kube-proxy + - containernetworking-plugins # required by crio ## General # Set the hostname to inventory_hostname diff --git a/kubespray/project/roles/bootstrap-os/files/bootstrap.sh b/kubespray/project/roles/bootstrap_os/files/bootstrap.sh similarity index 100% rename from kubespray/project/roles/bootstrap-os/files/bootstrap.sh rename to kubespray/project/roles/bootstrap_os/files/bootstrap.sh diff --git a/kubespray/project/roles/bootstrap-os/handlers/main.yml b/kubespray/project/roles/bootstrap_os/handlers/main.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/handlers/main.yml rename to kubespray/project/roles/bootstrap_os/handlers/main.yml diff --git a/kubespray/project/roles/bootstrap_os/meta/main.yml b/kubespray/project/roles/bootstrap_os/meta/main.yml new file mode 100644 index 0000000..5b1432e --- /dev/null +++ b/kubespray/project/roles/bootstrap_os/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: kubespray_defaults diff --git a/kubespray/project/roles/bootstrap-os/molecule/default/converge.yml b/kubespray/project/roles/bootstrap_os/molecule/default/converge.yml similarity index 61% rename from kubespray/project/roles/bootstrap-os/molecule/default/converge.yml rename to kubespray/project/roles/bootstrap_os/molecule/default/converge.yml index 89a8325..081ca84 100644 --- a/kubespray/project/roles/bootstrap-os/molecule/default/converge.yml +++ b/kubespray/project/roles/bootstrap_os/molecule/default/converge.yml @@ -2,5 +2,6 @@ - name: Converge hosts: all gather_facts: false + become: true roles: - - role: bootstrap-os + - role: bootstrap_os diff --git a/kubespray/project/roles/bootstrap_os/molecule/default/molecule.yml b/kubespray/project/roles/bootstrap_os/molecule/default/molecule.yml new file mode 100644 index 0000000..bdb3d85 --- /dev/null +++ b/kubespray/project/roles/bootstrap_os/molecule/default/molecule.yml @@ -0,0 +1,37 @@ +--- +role_name_check: 1 +dependency: + name: galaxy +platforms: + - name: ubuntu20 + cloud_image: ubuntu-2004 + vm_cpu_cores: 1 + vm_memory: 512 + - name: ubuntu22 + cloud_image: ubuntu-2204 + vm_cpu_cores: 1 + vm_memory: 512 + - name: almalinux9 + cloud_image: almalinux-9 + vm_cpu_cores: 1 + vm_memory: 512 + - name: debian12 + cloud_image: debian-12 + vm_cpu_cores: 1 + vm_memory: 512 +provisioner: + name: ansible + config_options: + defaults: + callbacks_enabled: profile_tasks + timeout: 120 + inventory: + group_vars: + all: + user: + name: foo + comment: My test comment + playbooks: + create: ../../../../tests/cloud_playbooks/create-kubevirt.yml +verifier: + name: testinfra diff --git a/kubespray/project/roles/bootstrap-os/molecule/default/tests/test_default.py b/kubespray/project/roles/bootstrap_os/molecule/default/tests/test_default.py similarity index 100% rename from kubespray/project/roles/bootstrap-os/molecule/default/tests/test_default.py rename to kubespray/project/roles/bootstrap_os/molecule/default/tests/test_default.py diff --git a/kubespray/project/roles/bootstrap-os/tasks/amzn.yml b/kubespray/project/roles/bootstrap_os/tasks/amzn.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/amzn.yml rename to kubespray/project/roles/bootstrap_os/tasks/amzn.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/centos.yml b/kubespray/project/roles/bootstrap_os/tasks/centos.yml similarity index 90% rename from kubespray/project/roles/bootstrap-os/tasks/centos.yml rename to kubespray/project/roles/bootstrap_os/tasks/centos.yml index 93816ff..a113c57 100644 --- a/kubespray/project/roles/bootstrap-os/tasks/centos.yml +++ b/kubespray/project/roles/bootstrap_os/tasks/centos.yml @@ -108,11 +108,3 @@ when: - fastestmirror.stat.exists - not centos_fastestmirror_enabled - -# libselinux-python is required on SELinux enabled hosts -# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements -- name: Install libselinux python package - package: - name: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}" - state: present - become: true diff --git a/kubespray/project/roles/bootstrap-os/tasks/clearlinux.yml b/kubespray/project/roles/bootstrap_os/tasks/clear-linux-os.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/clearlinux.yml rename to kubespray/project/roles/bootstrap_os/tasks/clear-linux-os.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/debian.yml b/kubespray/project/roles/bootstrap_os/tasks/debian.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/debian.yml rename to kubespray/project/roles/bootstrap_os/tasks/debian.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/fedora-coreos.yml b/kubespray/project/roles/bootstrap_os/tasks/fedora-coreos.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/fedora-coreos.yml rename to kubespray/project/roles/bootstrap_os/tasks/fedora-coreos.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/fedora.yml b/kubespray/project/roles/bootstrap_os/tasks/fedora.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/fedora.yml rename to kubespray/project/roles/bootstrap_os/tasks/fedora.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/flatcar.yml b/kubespray/project/roles/bootstrap_os/tasks/flatcar.yml similarity index 87% rename from kubespray/project/roles/bootstrap-os/tasks/flatcar.yml rename to kubespray/project/roles/bootstrap_os/tasks/flatcar.yml index be74150..d73e0fc 100644 --- a/kubespray/project/roles/bootstrap-os/tasks/flatcar.yml +++ b/kubespray/project/roles/bootstrap_os/tasks/flatcar.yml @@ -23,7 +23,7 @@ - name: Make interpreter discovery works on Flatcar set_fact: - ansible_interpreter_python_fallback: "{{ ansible_interpreter_python_fallback + [ '/opt/bin/python' ] }}" + ansible_interpreter_python_fallback: "{{ (ansible_interpreter_python_fallback | default([])) + ['/opt/bin/python'] }}" - name: Disable auto-upgrade systemd_service: diff --git a/kubespray/project/roles/bootstrap_os/tasks/main.yml b/kubespray/project/roles/bootstrap_os/tasks/main.yml new file mode 100644 index 0000000..71620a4 --- /dev/null +++ b/kubespray/project/roles/bootstrap_os/tasks/main.yml @@ -0,0 +1,62 @@ +--- +- name: Fetch /etc/os-release + raw: cat /etc/os-release + register: os_release + changed_when: false + # This command should always run, even in check mode + check_mode: false + +- name: Include distro specifics vars and tasks + vars: + os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') | + map('split', '=') | community.general.dict }}" + block: + - name: Include vars + include_vars: "{{ item }}" + tags: + - facts + with_first_found: + - &search + files: + - "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml" + - "{{ os_release_dict['ID'] }}.yml" + paths: + - vars/ + skip: true + - name: Include tasks + include_tasks: "{{ included_tasks_file }}" + with_first_found: + - <<: *search + paths: [] + loop_control: + loop_var: included_tasks_file + +- name: Install system packages + import_role: + name: system_packages + tags: + - system-packages + +- name: Create remote_tmp for it is used by another module + file: + path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}" + state: directory + mode: "0700" + +- name: Gather facts + setup: + gather_subset: '!all' + filter: ansible_* + +- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora) + hostname: + name: "{{ inventory_hostname }}" + when: override_system_hostname + +- name: Ensure bash_completion.d folder exists + file: + name: /etc/bash_completion.d/ + state: directory + owner: root + group: root + mode: "0755" diff --git a/kubespray/project/roles/bootstrap-os/tasks/openEuler.yml b/kubespray/project/roles/bootstrap_os/tasks/openEuler.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/openEuler.yml rename to kubespray/project/roles/bootstrap_os/tasks/openEuler.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/opensuse-leap.yml b/kubespray/project/roles/bootstrap_os/tasks/opensuse-leap.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/opensuse-leap.yml rename to kubespray/project/roles/bootstrap_os/tasks/opensuse-leap.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/opensuse-tumbleweed.yml b/kubespray/project/roles/bootstrap_os/tasks/opensuse-tumbleweed.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/opensuse-tumbleweed.yml rename to kubespray/project/roles/bootstrap_os/tasks/opensuse-tumbleweed.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/opensuse.yml b/kubespray/project/roles/bootstrap_os/tasks/opensuse.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/tasks/opensuse.yml rename to kubespray/project/roles/bootstrap_os/tasks/opensuse.yml diff --git a/kubespray/project/roles/bootstrap-os/tasks/redhat.yml b/kubespray/project/roles/bootstrap_os/tasks/rhel.yml similarity index 89% rename from kubespray/project/roles/bootstrap-os/tasks/redhat.yml rename to kubespray/project/roles/bootstrap_os/tasks/rhel.yml index 2bf508d..adfbb1a 100644 --- a/kubespray/project/roles/bootstrap-os/tasks/redhat.yml +++ b/kubespray/project/roles/bootstrap_os/tasks/rhel.yml @@ -28,6 +28,7 @@ register: rh_subscription_status changed_when: "rh_subscription_status.rc != 0" ignore_errors: true # noqa ignore-errors + timeout: "{{ rh_subscription_check_timeout }}" become: true - name: RHEL subscription Organization ID/Activation Key registration @@ -92,11 +93,3 @@ when: - fastestmirror.stat.exists - not centos_fastestmirror_enabled - -# libselinux-python is required on SELinux enabled hosts -# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements -- name: Install libselinux python package - package: - name: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}" - state: present - become: true diff --git a/kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml b/kubespray/project/roles/bootstrap_os/tasks/ubuntu.yml similarity index 77% rename from kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml rename to kubespray/project/roles/bootstrap_os/tasks/ubuntu.yml index 545de94..443c953 100644 --- a/kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml +++ b/kubespray/project/roles/bootstrap_os/tasks/ubuntu.yml @@ -19,3 +19,11 @@ when: - ubuntu_kernel_unattended_upgrades_disabled - unattended_upgrades_file_stat.stat.exists + +- name: Stop unattended-upgrades service + service: + name: unattended-upgrades + state: stopped + enabled: false + become: true + when: ubuntu_stop_unattended_upgrades diff --git a/kubespray/project/roles/bootstrap-os/vars/fedora-coreos.yml b/kubespray/project/roles/bootstrap_os/vars/fedora-coreos.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/vars/fedora-coreos.yml rename to kubespray/project/roles/bootstrap_os/vars/fedora-coreos.yml diff --git a/kubespray/project/roles/bootstrap-os/vars/flatcar.yml b/kubespray/project/roles/bootstrap_os/vars/flatcar.yml similarity index 100% rename from kubespray/project/roles/bootstrap-os/vars/flatcar.yml rename to kubespray/project/roles/bootstrap_os/vars/flatcar.yml diff --git a/kubespray/project/roles/container-engine/containerd-common/defaults/main.yml b/kubespray/project/roles/container-engine/containerd-common/defaults/main.yml index ae1c6e0..bceb5c5 100644 --- a/kubespray/project/roles/container-engine/containerd-common/defaults/main.yml +++ b/kubespray/project/roles/container-engine/containerd-common/defaults/main.yml @@ -3,15 +3,3 @@ # manager controlled installs to direct download ones. containerd_package: 'containerd.io' yum_repo_dir: /etc/yum.repos.d - -# Keep minimal repo information around for cleanup -containerd_repo_info: - repos: - -# Ubuntu docker-ce repo -containerd_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu" -containerd_ubuntu_repo_component: "stable" - -# Debian docker-ce repo -containerd_debian_repo_base_url: "https://download.docker.com/linux/debian" -containerd_debian_repo_component: "stable" diff --git a/kubespray/project/roles/container-engine/containerd/defaults/main.yml b/kubespray/project/roles/container-engine/containerd/defaults/main.yml index f04bb92..7f76ef3 100644 --- a/kubespray/project/roles/container-engine/containerd/defaults/main.yml +++ b/kubespray/project/roles/container-engine/containerd/defaults/main.yml @@ -17,8 +17,8 @@ containerd_runc_runtime: root: "" base_runtime_spec: cri-base.json options: - systemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}" - binaryName: "{{ bin_dir }}/runc" + SystemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}" + BinaryName: "{{ bin_dir }}/runc" containerd_additional_runtimes: [] # Example for Kata Containers as additional runtime: @@ -62,8 +62,10 @@ containerd_registries_mirrors: - host: https://registry-1.docker.io capabilities: ["pull", "resolve"] skip_verify: false +# ca: ["/etc/certs/mirror.pem"] +# client: [["/etc/certs/client.pem", ""],["/etc/certs/client.cert", "/etc/certs/client.key"]] -containerd_max_container_log_line_size: -1 +containerd_max_container_log_line_size: 16384 # If enabled it will allow non root users to use port numbers <1024 containerd_enable_unprivileged_ports: false @@ -90,12 +92,9 @@ containerd_registry_auth: [] # Configure containerd service containerd_limit_proc_num: "infinity" containerd_limit_core: "infinity" -containerd_limit_open_file_num: "infinity" +containerd_limit_open_file_num: 1048576 containerd_limit_mem_lock: "infinity" -# If enabled it will use config_path and config to be put in {{ containerd_cfg_dir }}/certs.d/ -containerd_use_config_path: false - # OS distributions that already support containerd containerd_supported_distributions: - "CentOS" @@ -123,7 +122,7 @@ enable_cdi: false # For containerd tracing configuration please check out the official documentation: # https://github.com/containerd/containerd/blob/main/docs/tracing.md containerd_tracing_enabled: false -containerd_tracing_endpoint: "0.0.0.0:4317" +containerd_tracing_endpoint: "[::]:4317" containerd_tracing_protocol: "grpc" containerd_tracing_sampling_ratio: 1.0 containerd_tracing_service_name: "containerd" diff --git a/kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml b/kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml index 7847871..2a061fc 100644 --- a/kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml +++ b/kubespray/project/roles/container-engine/containerd/molecule/default/converge.yml @@ -5,5 +5,5 @@ vars: container_manager: containerd roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: container-engine/containerd diff --git a/kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml b/kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml index 4c5c48f..0ad3b79 100644 --- a/kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml +++ b/kubespray/project/roles/container-engine/containerd/molecule/default/molecule.yml @@ -1,40 +1,30 @@ --- role_name_check: 1 -driver: - name: vagrant - provider: - name: libvirt platforms: - - name: ubuntu20 - box: generic/ubuntu2004 - cpus: 1 - memory: 1024 - groups: + - cloud_image: ubuntu-2004 + name: ubuntu20 + vm_cpu_cores: 1 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm - - name: debian11 - box: generic/debian11 - cpus: 1 - memory: 1024 - groups: + - cloud_image: debian-11 + name: debian11 + vm_cpu_cores: 1 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm - - name: almalinux8 - box: almalinux/8 - cpus: 1 - memory: 1024 - groups: + - cloud_image: almalinux-9 + name: almalinux9 + vm_cpu_cores: 1 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm provisioner: name: ansible env: @@ -43,5 +33,7 @@ provisioner: defaults: callbacks_enabled: profile_tasks timeout: 120 + playbooks: + create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml verifier: name: testinfra diff --git a/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml b/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml index a3d09ad..6b8d07b 100644 --- a/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml +++ b/kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml @@ -6,8 +6,9 @@ vars: ignore_assert_errors: true roles: - - role: kubespray-defaults - - role: bootstrap-os + - role: kubespray_defaults + - role: bootstrap_os + - role: network_facts - role: kubernetes/preinstall - role: adduser user: "{{ addusers.kube }}" @@ -25,5 +26,5 @@ ignore_assert_errors: true kube_network_plugin: cni roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: network_plugin/cni diff --git a/kubespray/project/roles/container-engine/containerd/tasks/main.yml b/kubespray/project/roles/container-engine/containerd/tasks/main.yml index 8b8c12c..fec1410 100644 --- a/kubespray/project/roles/container-engine/containerd/tasks/main.yml +++ b/kubespray/project/roles/container-engine/containerd/tasks/main.yml @@ -1,31 +1,4 @@ --- -- name: Fail containerd setup if distribution is not supported - fail: - msg: "{{ ansible_distribution }} is not supported by containerd." - when: - - not (allow_unsupported_distribution_setup | default(false)) and (ansible_distribution not in containerd_supported_distributions) - -- name: Containerd | Remove any package manager controlled containerd package - package: - name: "{{ containerd_package }}" - state: absent - when: - - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar")) - -- name: Containerd | Remove containerd repository - file: - path: "{{ yum_repo_dir }}/containerd.repo" - state: absent - when: - - ansible_os_family in ['RedHat'] - -- name: Containerd | Remove containerd repository - apt_repository: - repo: "{{ item }}" - state: absent - with_items: "{{ containerd_repo_info.repos }}" - when: ansible_pkg_mgr == 'apt' - - name: Containerd | Download containerd include_tasks: "../../../download/tasks/download_file.yml" vars: @@ -41,21 +14,6 @@ - --strip-components=1 notify: Restart containerd -- name: Containerd | Remove orphaned binary - file: - path: "/usr/bin/{{ item }}" - state: absent - when: - - containerd_bin_dir != "/usr/bin" - - not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar")) - ignore_errors: true # noqa ignore-errors - with_items: - - containerd - - containerd-shim - - containerd-shim-runc-v1 - - containerd-shim-runc-v2 - - ctr - - name: Containerd | Generate systemd service for containerd template: src: containerd.service.j2 @@ -108,14 +66,13 @@ - name: Containerd | Copy containerd config file template: - src: config.toml.j2 + src: "{{ 'config.toml.j2' if containerd_version is version('2.0.0', '>=') else 'config-v1.toml.j2' }}" dest: "{{ containerd_cfg_dir }}/config.toml" owner: "root" mode: "0640" notify: Restart containerd - name: Containerd | Configure containerd registries - when: containerd_registries_mirrors is defined block: - name: Containerd | Create registry directories file: diff --git a/kubespray/project/roles/container-engine/containerd/tasks/reset.yml b/kubespray/project/roles/container-engine/containerd/tasks/reset.yml index 517e56d..0e70cde 100644 --- a/kubespray/project/roles/container-engine/containerd/tasks/reset.yml +++ b/kubespray/project/roles/container-engine/containerd/tasks/reset.yml @@ -1,22 +1,4 @@ --- -- name: Containerd | Remove containerd repository for RedHat os family - file: - path: "{{ yum_repo_dir }}/containerd.repo" - state: absent - when: - - ansible_os_family in ['RedHat'] - tags: - - reset_containerd - -- name: Containerd | Remove containerd repository for Debian os family - apt_repository: - repo: "{{ item }}" - state: absent - with_items: "{{ containerd_repo_info.repos }}" - when: ansible_pkg_mgr == 'apt' - tags: - - reset_containerd - - name: Containerd | Stop containerd service service: name: containerd diff --git a/kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2 b/kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2 new file mode 100644 index 0000000..de59250 --- /dev/null +++ b/kubespray/project/roles/container-engine/containerd/templates/config-v1.toml.j2 @@ -0,0 +1,102 @@ +# This is for containerd v1 for compatibility +version = 2 + +root = "{{ containerd_storage_dir }}" +state = "{{ containerd_state_dir }}" +oom_score = {{ containerd_oom_score }} + +{% if containerd_extra_args is defined %} +{{ containerd_extra_args }} +{% endif %} + +[grpc] + max_recv_message_size = {{ containerd_grpc_max_recv_message_size }} + max_send_message_size = {{ containerd_grpc_max_send_message_size }} + +[debug] + address = "{{ containerd_debug_address }}" + level = "{{ containerd_debug_level }}" + format = "{{ containerd_debug_format }}" + uid = {{ containerd_debug_uid }} + gid = {{ containerd_debug_gid }} + +[metrics] + address = "{{ containerd_metrics_address }}" + grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }} + +[plugins] + [plugins."io.containerd.grpc.v1.cri"] + sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}" + max_container_log_line_size = {{ containerd_max_container_log_line_size }} + enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }} + enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }} + enable_selinux = {{ containerd_enable_selinux | lower }} + disable_apparmor = {{ containerd_disable_apparmor | lower }} + tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }} + disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }} + image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}" +{% if enable_cdi %} + enable_cdi = true + cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"] +{% endif %} + [plugins."io.containerd.grpc.v1.cri".containerd] + default_runtime_name = "{{ containerd_default_runtime }}" + snapshotter = "{{ containerd_snapshotter }}" + discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }} + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] +{% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %} + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}] + runtime_type = "{{ runtime.type }}" + runtime_engine = "{{ runtime.engine }}" + runtime_root = "{{ runtime.root }}" +{% if runtime.base_runtime_spec is defined %} + base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}" +{% endif %} + + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options] +{% for key, value in runtime.options.items() %} +{% if value | string != "true" and value | string != "false" %} + {{ key }} = "{{ value }}" +{% else %} + {{ key }} = {{ value }} +{% endif %} +{% endfor %} +{% endfor %} +{% if kata_containers_enabled %} + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu] + runtime_type = "io.containerd.kata-qemu.v2" +{% endif %} +{% if gvisor_enabled %} + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc] + runtime_type = "io.containerd.runsc.v1" +{% endif %} + [plugins."io.containerd.grpc.v1.cri".registry] + config_path = "{{ containerd_cfg_dir }}/certs.d" +{% for registry in containerd_registry_auth if registry['registry'] is defined %} +{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %} + [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth] +{% if registry['username'] is defined and registry['password'] is defined %} + password = "{{ registry['password'] }}" + username = "{{ registry['username'] }}" +{% else %} + auth = "{{ registry['auth'] }}" +{% endif %} +{% endif %} +{% endfor %} + +{% if nri_enabled and containerd_version is version('1.7.0', '>=') %} + [plugins."io.containerd.nri.v1.nri"] + disable = false +{% endif %} + +{% if containerd_tracing_enabled %} + [plugins."io.containerd.tracing.processor.v1.otlp"] + endpoint = "{{ containerd_tracing_endpoint }}" + protocol = "{{ containerd_tracing_protocol }}" +{% if containerd_tracing_protocol == "grpc" %} + insecure = false +{% endif %} + [plugins."io.containerd.internal.v1.tracing"] + sampling_ratio = {{ containerd_tracing_sampling_ratio }} + service_name = "{{ containerd_tracing_service_name }}" +{% endif %} diff --git a/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2 b/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2 index 3f65ef5..8b1c5c2 100644 --- a/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2 +++ b/kubespray/project/roles/container-engine/containerd/templates/config.toml.j2 @@ -1,4 +1,5 @@ -version = 2 +version = 3 + root = "{{ containerd_storage_dir }}" state = "{{ containerd_state_dir }}" oom_score = {{ containerd_oom_score }} @@ -23,8 +24,7 @@ oom_score = {{ containerd_oom_score }} grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }} [plugins] - [plugins."io.containerd.grpc.v1.cri"] - sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}" + [plugins."io.containerd.cri.v1.runtime"] max_container_log_line_size = {{ containerd_max_container_log_line_size }} enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }} enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }} @@ -32,78 +32,52 @@ oom_score = {{ containerd_oom_score }} disable_apparmor = {{ containerd_disable_apparmor | lower }} tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }} disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }} - image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}" {% if enable_cdi %} enable_cdi = true cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"] {% endif %} - [plugins."io.containerd.grpc.v1.cri".containerd] - default_runtime_name = "{{ containerd_default_runtime }}" - snapshotter = "{{ containerd_snapshotter }}" - discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] + + [plugins."io.containerd.cri.v1.runtime".containerd] + default_runtime_name = "{{ containerd_default_runtime }}" + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes] {% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}] - runtime_type = "{{ runtime.type }}" - runtime_engine = "{{ runtime.engine }}" - runtime_root = "{{ runtime.root }}" + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}] + runtime_type = "{{ runtime.type }}" + runtime_engine = "{{ runtime.engine }}" + runtime_root = "{{ runtime.root }}" {% if runtime.base_runtime_spec is defined %} - base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}" + base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}" {% endif %} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options] + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}.options] {% for key, value in runtime.options.items() %} {% if value | string != "true" and value | string != "false" %} - {{ key }} = "{{ value }}" + {{ key }} = "{{ value }}" {% else %} - {{ key }} = {{ value }} + {{ key }} = {{ value }} {% endif %} {% endfor %} {% endfor %} {% if kata_containers_enabled %} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu] - runtime_type = "io.containerd.kata-qemu.v2" + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata-qemu] + runtime_type = "io.containerd.kata-qemu.v2" {% endif %} {% if gvisor_enabled %} - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc] - runtime_type = "io.containerd.runsc.v1" + [plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runsc] + runtime_type = "io.containerd.runsc.v1" {% endif %} - [plugins."io.containerd.grpc.v1.cri".registry] -{% if containerd_use_config_path is defined and containerd_use_config_path|bool %} - config_path = "{{ containerd_cfg_dir }}/certs.d" -{% else %} - [plugins."io.containerd.grpc.v1.cri".registry.mirrors] -{% set insecure_registries_addr = [] %} -{% for registry in containerd_registries_mirrors %} - [plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{ registry.prefix }}"] -{% set endpoint = [] %} -{% for mirror in registry.mirrors %} -{% if endpoint.append(mirror.host) %}{% endif %} -{% if mirror.skip_verify is defined and mirror.skip_verify|bool %}{% if insecure_registries_addr.append(mirror.host | urlsplit('netloc')) %}{% endif %}{% endif %} -{% endfor %} - endpoint = ["{{ ( endpoint | unique ) | join('","') }}"] -{% endfor %} -{% for addr in insecure_registries_addr | unique %} - [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ addr }}".tls] - insecure_skip_verify = true -{% endfor %} -{% endif %} -{% for registry in containerd_registry_auth if registry['registry'] is defined %} -{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %} - [plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth] -{% if registry['username'] is defined and registry['password'] is defined %} - password = "{{ registry['password'] }}" - username = "{{ registry['username'] }}" -{% else %} - auth = "{{ registry['auth'] }}" -{% endif %} -{% endif %} -{% endfor %} -{% if nri_enabled and containerd_version is version('1.7.0', '>=') %} + [plugins."io.containerd.cri.v1.images"] + snapshotter = "{{ containerd_snapshotter }}" + discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }} + image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}" + [plugins."io.containerd.cri.v1.images".pinned_images] + sandbox = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}" + [plugins."io.containerd.cri.v1.images".registry] + config_path = "{{ containerd_cfg_dir }}/certs.d" + [plugins."io.containerd.nri.v1.nri"] - disable = false -{% endif %} + disable = {{ 'false' if nri_enabled else 'true' }} {% if containerd_tracing_enabled %} [plugins."io.containerd.tracing.processor.v1.otlp"] diff --git a/kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2 b/kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2 index 06b2290..fbb950a 100644 --- a/kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2 +++ b/kubespray/project/roles/container-engine/containerd/templates/containerd.service.j2 @@ -15,7 +15,7 @@ [Unit] Description=containerd container runtime Documentation=https://containerd.io -After=network.target local-fs.target +After=network.target local-fs.target dbus.service [Service] ExecStartPre=-/sbin/modprobe overlay diff --git a/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2 b/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2 index ef63ff1..b2b16a6 100644 --- a/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2 +++ b/kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2 @@ -4,4 +4,10 @@ server = "{{ item.server | default("https://" + item.prefix) }}" capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"] skip_verify = {{ mirror.skip_verify | default('false') | string | lower }} override_path = {{ mirror.override_path | default('false') | string | lower }} +{% if mirror.ca is defined %} + ca = ["{{ ([ mirror.ca ] | flatten ) | join('","') }}"] +{% endif %} +{% if mirror.client is defined %} + client = [{% for pair in mirror.client %}["{{ pair[0] }}", "{{ pair[1] }}"]{% if not loop.last %},{% endif %}{% endfor %}] +{% endif %} {% endfor %} diff --git a/kubespray/project/roles/container-engine/containerd/vars/debian.yml b/kubespray/project/roles/container-engine/containerd/vars/debian.yml deleted file mode 100644 index 8b18d9a..0000000 --- a/kubespray/project/roles/container-engine/containerd/vars/debian.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -containerd_repo_info: - repos: - - > - deb {{ containerd_debian_repo_base_url }} - {{ ansible_distribution_release | lower }} - {{ containerd_debian_repo_component }} diff --git a/kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml b/kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml deleted file mode 100644 index dd77532..0000000 --- a/kubespray/project/roles/container-engine/containerd/vars/ubuntu.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -containerd_repo_info: - repos: - - > - deb {{ containerd_ubuntu_repo_base_url }} - {{ ansible_distribution_release | lower }} - {{ containerd_ubuntu_repo_component }} diff --git a/kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml b/kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml new file mode 100644 index 0000000..53e337b --- /dev/null +++ b/kubespray/project/roles/container-engine/cri-dockerd/defaults/main.yml @@ -0,0 +1,3 @@ +--- +# Default is "info" (like if not provided). Possible values are any log level string parseable by logrus +cri_dockerd_log_level: "info" diff --git a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml index be6fa38..0505373 100644 --- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml +++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/converge.yml @@ -5,5 +5,5 @@ vars: container_manager: docker roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: container-engine/cri-dockerd diff --git a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml index 82cb778..cff276e 100644 --- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml +++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/molecule.yml @@ -1,28 +1,18 @@ --- role_name_check: 1 -driver: - name: vagrant - provider: - name: libvirt platforms: - - name: almalinux8 - box: almalinux/8 - cpus: 1 - memory: 1024 - nested: true - groups: + - name: almalinux9 + cloud_image: almalinux-9 + vm_cpu_cores: 1 + vm_memory: 1024 + node_groups: - kube_control_plane - provider_options: - driver: kvm - name: ubuntu20 - box: generic/ubuntu2004 - cpus: 1 - memory: 1024 - nested: true - groups: + cloud_image: ubuntu-2004 + vm_cpu_cores: 1 + vm_memory: 1024 + node_groups: - kube_control_plane - provider_options: - driver: kvm provisioner: name: ansible env: @@ -35,5 +25,7 @@ provisioner: group_vars: all: become: true + playbooks: + create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml verifier: name: testinfra diff --git a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml index b532842..dc470a5 100644 --- a/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml +++ b/kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml @@ -3,8 +3,8 @@ hosts: all become: true roles: - - role: kubespray-defaults - - role: bootstrap-os + - role: kubespray_defaults + - role: bootstrap_os - role: adduser user: "{{ addusers.kube }}" tasks: @@ -20,7 +20,7 @@ container_manager: containerd kube_network_plugin: cni roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: network_plugin/cni tasks: - name: Copy test container files diff --git a/kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2 b/kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2 index ec12815..b539305 100644 --- a/kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2 +++ b/kubespray/project/roles/container-engine/cri-dockerd/templates/cri-dockerd.service.j2 @@ -7,7 +7,7 @@ Requires=cri-dockerd.socket [Service] Type=notify -ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnet }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} {% if enable_dual_stack_networks %}--ipv6-dual-stack=True{% endif %} +ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnets }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} --log-level {{ cri_dockerd_log_level }} {% if ipv6_stack %}--ipv6-dual-stack=True{% endif %} ExecReload=/bin/kill -s HUP $MAINPID TimeoutSec=0 diff --git a/kubespray/project/roles/container-engine/cri-o/defaults/main.yml b/kubespray/project/roles/container-engine/cri-o/defaults/main.yml index 6bc0d72..4de3b17 100644 --- a/kubespray/project/roles/container-engine/cri-o/defaults/main.yml +++ b/kubespray/project/roles/container-engine/cri-o/defaults/main.yml @@ -2,6 +2,8 @@ crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}" crio_conmon: "{{ bin_dir }}/conmon" +crio_default_runtime: "crun" +crio_libexec_dir: "/usr/libexec/crio" crio_enable_metrics: false crio_log_level: "info" crio_metrics_port: "9090" @@ -35,14 +37,16 @@ crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/def crio_stream_port: "10010" -crio_required_version: "{{ kube_version | regex_replace('^v(?P\\d+).(?P\\d+).(?P\\d+)$', '\\g.\\g') }}" +crio_required_version: "{{ kube_version | regex_replace('^(?P\\d+).(?P\\d+).(?P\\d+)$', '\\g.\\g') }}" + +crio_root: "/var/lib/containers/storage" # The crio_runtimes variable defines a list of OCI compatible runtimes. crio_runtimes: - - name: runc - path: "{{ bin_dir }}/runc" + - name: crun + path: "{{ crio_runtime_bin_dir }}/crun" type: oci - root: /run/runc + root: /run/crun # Kata Containers is an OCI runtime, where containers are run inside lightweight # VMs. Kata provides additional isolation towards the host, minimizing the host attack @@ -55,10 +59,16 @@ kata_runtimes: root: /run/kata-containers privileged_without_host_devices: true +runc_runtime: + name: runc + path: "{{ crio_runtime_bin_dir }}/runc" + type: oci + root: /run/runc + # crun is a fast and low-memory footprint OCI Container Runtime fully written in C. crun_runtime: name: crun - path: "{{ bin_dir }}/crun" + path: "{{ crio_runtime_bin_dir }}/crun" type: oci root: /run/crun @@ -89,3 +99,15 @@ crio_man_files: # If set to true, it will enable the CRIU support in cri-o crio_criu_support_enabled: false + +# Configure default_capabilities in crio.conf +crio_default_capabilities: + - CHOWN + - DAC_OVERRIDE + - FSETID + - FOWNER + - SETGID + - SETUID + - SETPCAP + - NET_BIND_SERVICE + - KILL diff --git a/kubespray/project/roles/container-engine/cri-o/meta/main.yml b/kubespray/project/roles/container-engine/cri-o/meta/main.yml index 7259b46..99e803a 100644 --- a/kubespray/project/roles/container-engine/cri-o/meta/main.yml +++ b/kubespray/project/roles/container-engine/cri-o/meta/main.yml @@ -1,5 +1,5 @@ --- dependencies: - - role: container-engine/runc + - role: container-engine/crun - role: container-engine/crictl - role: container-engine/skopeo diff --git a/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml b/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml index 376f07c..85361b4 100644 --- a/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml +++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/converge.yml @@ -5,5 +5,5 @@ vars: container_manager: crio roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: container-engine/cri-o diff --git a/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml b/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml index 99d44a3..6bbaabf 100644 --- a/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml +++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/molecule.yml @@ -1,50 +1,38 @@ --- role_name_check: 1 -driver: - name: vagrant - provider: - name: libvirt platforms: - name: ubuntu20 - box: generic/ubuntu2004 - cpus: 2 - memory: 1024 - groups: + cloud_image: ubuntu-2004 + vm_cpu_cores: 2 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm - - name: almalinux8 - box: almalinux/8 - cpus: 2 - memory: 1024 - groups: + - name: almalinux9 + cloud_image: almalinux-9 + vm_cpu_cores: 2 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm - name: fedora - box: fedora/38-cloud-base - cpus: 2 - memory: 2048 - groups: + cloud_image: fedora-39 + vm_cpu_cores: 2 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm - - name: debian10 - box: generic/debian10 - cpus: 2 - memory: 1024 - groups: + - name: debian12 + cloud_image: debian-12 + vm_cpu_cores: 2 + vm_memory: 1024 + node_groups: - kube_control_plane - kube_node - k8s_cluster - provider_options: - driver: kvm provisioner: name: ansible env: @@ -53,5 +41,7 @@ provisioner: defaults: callbacks_enabled: profile_tasks timeout: 120 + playbooks: + create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml verifier: name: testinfra diff --git a/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml b/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml index 55ad517..6fa4d3d 100644 --- a/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml +++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml @@ -6,8 +6,9 @@ vars: ignore_assert_errors: true roles: - - role: kubespray-defaults - - role: bootstrap-os + - role: kubespray_defaults + - role: bootstrap_os + - role: network_facts - role: kubernetes/preinstall - role: adduser user: "{{ addusers.kube }}" @@ -25,7 +26,7 @@ ignore_assert_errors: true kube_network_plugin: cni roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: network_plugin/cni tasks: - name: Copy test container files diff --git a/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py b/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py index 358a1b7..3e38fa5 100644 --- a/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py +++ b/kubespray/project/roles/container-engine/cri-o/molecule/default/tests/test_default.py @@ -21,7 +21,7 @@ def test_run(host): assert "RuntimeName: cri-o" in cmd.stdout def test_run_pod(host): - runtime = "runc" + runtime = "crun" run_command = "/usr/local/bin/crictl run --with-pull --runtime {} /tmp/container.json /tmp/sandbox.json".format(runtime) with host.sudo(): diff --git a/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml b/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml index 8a5daa3..99fc964 100644 --- a/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml +++ b/kubespray/project/roles/container-engine/cri-o/tasks/load_vars.yml @@ -1,8 +1,8 @@ --- -- name: Cri-o | include vars/v1.28.yml - include_vars: v1.28.yml - when: crio_version is version("v1.29.0", operator="<") - - name: Cri-o | include vars/v1.29.yml include_vars: v1.29.yml - when: crio_version is version("v1.29.0", operator=">=") + when: crio_version is version("1.29.0", operator=">=") + +- name: Cri-o | include vars/v1.31.yml + include_vars: v1.31.yml + when: crio_version is version("1.31.0", operator=">=") diff --git a/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml b/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml index bde2e07..5027cdb 100644 --- a/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml +++ b/kubespray/project/roles/container-engine/cri-o/tasks/main.yaml @@ -36,11 +36,18 @@ when: - kata_containers_enabled -- name: Cri-o | build a list of crio runtimes with crun runtime +## After CRI-O v1.31, crun is default runtime. +# - name: Cri-o | build a list of crio runtimes with crun runtime +# set_fact: +# crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}" +# when: +# - crun_enabled + +- name: Cri-o | build a list of crio runtimes with runc runtime set_fact: - crio_runtimes: "{{ crio_runtimes + [crun_runtime] }}" + crio_runtimes: "{{ crio_runtimes + [runc_runtime] }}" when: - - crun_enabled + - runc_enabled - name: Cri-o | build a list of crio runtimes with youki runtime set_fact: @@ -82,6 +89,23 @@ - "{{ crio_bin_files }}" notify: Restart crio +- name: Cri-o | create directory for libexec + file: + path: "{{ crio_libexec_dir }}" + state: directory + owner: root + mode: "0755" + +- name: Cri-o | copy libexec + copy: + src: "{{ local_release_dir }}/cri-o/bin/{{ item }}" + dest: "{{ crio_libexec_dir }}/{{ item }}" + mode: "0755" + remote_src: true + with_items: + - "{{ crio_libexec_files }}" + notify: Restart crio + - name: Cri-o | copy service file copy: src: "{{ local_release_dir }}/cri-o/contrib/crio.service" @@ -156,7 +180,7 @@ dest: /etc/containers/storage.conf section: storage.options.overlay option: mountopt - value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}' + value: '{{ ''"nodev"'' if ansible_kernel is version(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}' mode: "0644" - name: Cri-o | create directory registries configs diff --git a/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml b/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml index 53d4714..485352f 100644 --- a/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml +++ b/kubespray/project/roles/container-engine/cri-o/tasks/reset.yml @@ -19,7 +19,7 @@ - name: CRI-O | Remove cri-o apt repo apt_repository: - repo: "deb {{ crio_download_crio }}{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /" + repo: "deb {{ crio_download_crio }}v{{ crio_version }}/{{ crio_kubic_debian_repo_name }}/ /" state: absent filename: devel-kubic-libcontainers-stable-cri-o when: crio_kubic_debian_repo_name is defined @@ -36,7 +36,7 @@ - name: CRI-O | Remove CRI-O kubic yum repo yum_repository: - name: "devel_kubic_libcontainers_stable_cri-o_{{ crio_version }}" + name: "devel_kubic_libcontainers_stable_cri-o_v{{ crio_version }}" state: absent when: - ansible_os_family == "RedHat" @@ -88,3 +88,11 @@ with_items: "{{ crio_bin_files }}" tags: - reset_crio + +- name: CRI-O | Remove CRI-O libexec + file: + name: "{{ item }}" + state: absent + with_items: "{{ crio_libexec_files }}" + tags: + - reset_crio diff --git a/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2 b/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2 index 6f9b84f..46b04cf 100644 --- a/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2 +++ b/kubespray/project/roles/container-engine/cri-o/templates/crio.conf.j2 @@ -17,7 +17,7 @@ # Path to the "root directory". CRI-O stores all of its data, including # containers images, in this directory. -root = "/var/lib/containers/storage" +root = "{{ crio_root }}" # Path to the "run directory". CRI-O stores all of its state in this directory. # Read from /etc/containers/storage.conf first so unnecessary here @@ -97,7 +97,7 @@ grpc_max_recv_msg_size = 16777216 # default_runtime is the _name_ of the OCI runtime to be used as the default. # The name is matched against the runtimes map below. -default_runtime = "runc" +default_runtime = "{{ crio_default_runtime }}" # If true, the runtime will not use pivot_root, but instead use MS_MOVE. no_pivot = false @@ -155,17 +155,9 @@ cgroup_manager = "{{ crio_cgroup_manager }}" # only the capabilities defined in the containers json file by the user/kube # will be added. default_capabilities = [ - "CHOWN", - "DAC_OVERRIDE", - "FSETID", - "FOWNER", - "NET_RAW", - "SETGID", - "SETUID", - "SETPCAP", - "NET_BIND_SERVICE", - "SYS_CHROOT", - "KILL", +{%- for item in crio_default_capabilities %} + "{{ item }}", +{%- endfor %} ] # List of default sysctls. If it is empty or commented out, only the sysctls @@ -382,7 +374,7 @@ enable_metrics = {{ crio_enable_metrics | bool | lower }} # The port on which the metrics server will listen. metrics_port = {{ crio_metrics_port }} -{% if nri_enabled and crio_version is version('v1.26.0', operator='>=') %} +{% if nri_enabled and crio_version is version('1.26.0', operator='>=') %} [crio.nri] enable_nri=true diff --git a/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml b/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml deleted file mode 100644 index a6a8b67..0000000 --- a/kubespray/project/roles/container-engine/cri-o/vars/v1.28.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# cri-o binary files -crio_bin_files: - - conmon - - crio - - crio-status - - pinns - -crio_status_command: crio-status diff --git a/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml b/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml index ddf34c7..d8e6ccf 100644 --- a/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml +++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml @@ -1,5 +1,6 @@ --- crio_conmon: "{{ bin_dir }}/crio-conmon" +crio_runtime_bin_dir: "{{ bin_dir }}" # cri-o binary files crio_bin_files: diff --git a/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml b/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml new file mode 100644 index 0000000..d84e00e --- /dev/null +++ b/kubespray/project/roles/container-engine/cri-o/vars/v1.31.yml @@ -0,0 +1,16 @@ +--- +crio_conmon: "{{ crio_libexec_dir }}/conmon" +crio_runtime_bin_dir: "{{ crio_libexec_dir }}" + +# cri-o binary files +crio_bin_files: + - crio + - pinns + +crio_libexec_files: + - conmon + - conmonrs + - crun + - runc + +crio_status_command: crio status diff --git a/kubespray/project/roles/container-engine/docker/defaults/main.yml b/kubespray/project/roles/container-engine/docker/defaults/main.yml index 4615176..543f8f2 100644 --- a/kubespray/project/roles/container-engine/docker/defaults/main.yml +++ b/kubespray/project/roles/container-engine/docker/defaults/main.yml @@ -1,5 +1,5 @@ --- -docker_version: '26.1' +docker_version: '28.0' docker_cli_version: "{{ docker_version }}" docker_package_info: @@ -53,8 +53,8 @@ docker_fedora_repo_base_url: 'https://download.docker.com/linux/fedora/{{ ansibl docker_fedora_repo_gpgkey: 'https://download.docker.com/linux/fedora/gpg' # CentOS/RedHat docker-ce repo -docker_rh_repo_base_url: 'https://download.docker.com/linux/centos/{{ ansible_distribution_major_version }}/$basearch/stable' -docker_rh_repo_gpgkey: 'https://download.docker.com/linux/centos/gpg' +docker_rh_repo_base_url: 'https://download.docker.com/linux/rhel/{{ ansible_distribution_major_version }}/$basearch/stable' +docker_rh_repo_gpgkey: 'https://download.docker.com/linux/rhel/gpg' # Ubuntu docker-ce repo docker_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu" diff --git a/kubespray/project/roles/container-engine/docker/tasks/main.yml b/kubespray/project/roles/container-engine/docker/tasks/main.yml index e56fe4c..46f3bce 100644 --- a/kubespray/project/roles/container-engine/docker/tasks/main.yml +++ b/kubespray/project/roles/container-engine/docker/tasks/main.yml @@ -50,7 +50,7 @@ apt_key: id: "{{ item }}" url: "{{ docker_repo_key_info.url }}" - keyring: "{{ docker_repo_key_keyring|default(omit) }}" + keyring: "{{ docker_repo_key_keyring | default(omit) }}" state: present register: keyserver_task_result until: keyserver_task_result is succeeded diff --git a/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml b/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml index d0ccd74..42a2c64 100644 --- a/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml +++ b/kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml @@ -10,12 +10,12 @@ - name: Add upstream dns servers set_fact: - docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers | default([]) }}" + docker_dns_servers: "{{ docker_dns_servers + upstream_dns_servers }}" when: dns_mode in ['coredns', 'coredns_dual'] - name: Add global searchdomains set_fact: - docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains | default([]) }}" + docker_dns_search_domains: "{{ docker_dns_search_domains + searchdomains }}" - name: Check system nameservers shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/' diff --git a/kubespray/project/roles/container-engine/docker/vars/debian.yml b/kubespray/project/roles/container-engine/docker/vars/debian.yml index f6d14d4..f5a0fc9 100644 --- a/kubespray/project/roles/container-engine/docker/vars/debian.yml +++ b/kubespray/project/roles/container-engine/docker/vars/debian.yml @@ -25,8 +25,17 @@ containerd_versioned_pkg: '1.6.28': "{{ containerd_package }}=1.6.28-2" '1.6.31': "{{ containerd_package }}=1.6.31-1" '1.6.32': "{{ containerd_package }}=1.6.32-1" - 'stable': "{{ containerd_package }}=1.6.32-1" - 'edge': "{{ containerd_package }}=1.6.32-1" + '1.6.33': "{{ containerd_package }}=1.6.33-1" + '1.7.18': "{{ containerd_package }}=1.7.18-1" + '1.7.19': "{{ containerd_package }}=1.7.19-1" + '1.7.20': "{{ containerd_package }}=1.7.20-1" + '1.7.21': "{{ containerd_package }}=1.7.21-1" + '1.7.22': "{{ containerd_package }}=1.7.22-1" + '1.7.23': "{{ containerd_package }}=1.7.23-1" + '1.7.24': "{{ containerd_package }}=1.7.24-1" + '1.7.25': "{{ containerd_package }}=1.7.25-1" + 'stable': "{{ containerd_package }}=1.7.25-1" + 'edge': "{{ containerd_package }}=1.7.25-1" # https://download.docker.com/linux/debian/ docker_versioned_pkg: @@ -38,9 +47,16 @@ docker_versioned_pkg: '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} - '26.1': docker-ce=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} - 'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} - 'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '26.1': docker-ce=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.0': docker-ce=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.1': docker-ce=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.2': docker-ce=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.3': docker-ce=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.4': docker-ce=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.5': docker-ce=5:27.5.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '28.0': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + 'stable': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + 'edge': docker-ce=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} docker_cli_versioned_pkg: 'latest': docker-ce-cli @@ -51,9 +67,16 @@ docker_cli_versioned_pkg: '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} - '26.1': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} - 'stable': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} - 'edge': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '26.1': docker-ce-cli=5:26.1.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.0': docker-ce-cli=5:27.0.3-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.1': docker-ce-cli=5:27.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.2': docker-ce-cli=5:27.2.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.3': docker-ce-cli=5:27.3.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.4': docker-ce-cli=5:27.4.1-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '27.5': docker-ce-cli=5:27.5.4-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + '28.0': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + 'stable': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} + 'edge': docker-ce-cli=5:28.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} docker_package_info: pkgs: diff --git a/kubespray/project/roles/container-engine/docker/vars/fedora.yml b/kubespray/project/roles/container-engine/docker/vars/fedora.yml index 392e553..f713acc 100644 --- a/kubespray/project/roles/container-engine/docker/vars/fedora.yml +++ b/kubespray/project/roles/container-engine/docker/vars/fedora.yml @@ -25,8 +25,17 @@ containerd_versioned_pkg: '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}" '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}" - 'stable': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}" - 'edge': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}" + '1.6.33': "{{ containerd_package }}-1.6.33-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.18': "{{ containerd_package }}-1.7.18-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.19': "{{ containerd_package }}-1.7.19-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.20': "{{ containerd_package }}-1.7.20-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.21': "{{ containerd_package }}-1.7.21-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.22': "{{ containerd_package }}-1.7.22-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.23': "{{ containerd_package }}-1.7.23-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.24': "{{ containerd_package }}-1.7.24-3.1.fc{{ ansible_distribution_major_version }}" + '1.7.25': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}" + 'stable': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}" + 'edge': "{{ containerd_package }}-1.7.25-3.1.fc{{ ansible_distribution_major_version }}" # https://docs.docker.com/install/linux/docker-ce/fedora/ # https://download.docker.com/linux/fedora//x86_64/stable/Packages/ @@ -37,9 +46,16 @@ docker_versioned_pkg: '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }} '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }} '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }} - '26.1': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }} - 'stable': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }} - 'edge': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }} + '26.1': docker-ce-3:26.1.4-1.fc{{ ansible_distribution_major_version }} + '27.0': docker-ce-3:27.0.3-1.fc{{ ansible_distribution_major_version }} + '27.1': docker-ce-3:27.1.2-1.fc{{ ansible_distribution_major_version }} + '27.2': docker-ce-3:27.2.1-1.fc{{ ansible_distribution_major_version }} + '27.3': docker-ce-3:27.3.1-1.fc{{ ansible_distribution_major_version }} + '27.4': docker-ce-3:27.4.1-1.fc{{ ansible_distribution_major_version }} + '27.5': docker-ce-3:27.5.1-1.fc{{ ansible_distribution_major_version }} + '28.0': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }} + 'stable': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }} + 'edge': docker-ce-3:28.0.2-1.fc{{ ansible_distribution_major_version }} docker_cli_versioned_pkg: 'latest': docker-ce-cli @@ -48,9 +64,16 @@ docker_cli_versioned_pkg: '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }} '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }} '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }} - '26.1': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }} - 'stable': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }} - 'edge': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }} + '26.1': docker-ce-cli-1:26.1.4-1.fc{{ ansible_distribution_major_version }} + '27.0': docker-ce-cli-1:27.0.3-1.fc{{ ansible_distribution_major_version }} + '27.1': docker-ce-cli-1:27.1.2-1.fc{{ ansible_distribution_major_version }} + '27.2': docker-ce-cli-1:27.2.1-1.fc{{ ansible_distribution_major_version }} + '27.3': docker-ce-cli-1:27.3.1-1.fc{{ ansible_distribution_major_version }} + '27.4': docker-ce-cli-1:27.4.1-1.fc{{ ansible_distribution_major_version }} + '27.5': docker-ce-cli-1:27.5.1-1.fc{{ ansible_distribution_major_version }} + '28.0': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }} + 'stable': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }} + 'edge': docker-ce-cli-1:28.0.2-1.fc{{ ansible_distribution_major_version }} docker_package_info: enablerepo: "docker-ce" diff --git a/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml b/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml deleted file mode 100644 index 26ec59c..0000000 --- a/kubespray/project/roles/container-engine/docker/vars/redhat-7.yml +++ /dev/null @@ -1,63 +0,0 @@ ---- -# containerd versions are only relevant for docker -containerd_versioned_pkg: - 'latest': "{{ containerd_package }}" - '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el7" - '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el7" - '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el7" - '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el7" - '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el7" - '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el7" - '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el7" - '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el7" - '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el7" - '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el7" - '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el7" - '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el7" - '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el7" - '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el7" - '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el7" - '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el7" - '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el7" - '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el7" - '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7" - '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7" - '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7" - '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el7" - '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el7" - 'stable': "{{ containerd_package }}-1.6.32-3.1.el7" - 'edge': "{{ containerd_package }}-1.6.32-3.1.el7" - -# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package -# https://download.docker.com/linux/centos/>/x86_64/stable/Packages/ -# or do 'yum --showduplicates list docker-engine' -docker_versioned_pkg: - 'latest': docker-ce - '18.09': docker-ce-18.09.9-3.el7 - '19.03': docker-ce-19.03.15-3.el7 - '20.10': docker-ce-20.10.20-3.el7 - '23.0': docker-ce-23.0.6-1.el7 - '24.0': docker-ce-24.0.9-1.el7 - '26.0': docker-ce-26.0.2-1.el7 - '26.1': docker-ce-26.1.2-1.el7 - 'stable': docker-ce-26.1.2-1.el7 - 'edge': docker-ce-26.1.2-1.el7 - -docker_cli_versioned_pkg: - 'latest': docker-ce-cli - '18.09': docker-ce-cli-18.09.9-3.el7 - '19.03': docker-ce-cli-19.03.15-3.el7 - '20.10': docker-ce-cli-20.10.20-3.el7 - '23.0': docker-ce-cli-23.0.6-1.el7 - '24.0': docker-ce-cli-24.0.9-1.el7 - '26.0': docker-ce-cli-26.0.2-1.el7 - '26.1': docker-ce-cli-26.1.2-1.el7 - 'stable': docker-ce-cli-26.1.2-1.el7 - 'edge': docker-ce-cli-26.1.2-1.el7 - -docker_package_info: - enablerepo: "docker-ce" - pkgs: - - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}" - - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}" - - "{{ docker_versioned_pkg[docker_version | string] }}" diff --git a/kubespray/project/roles/container-engine/docker/vars/redhat.yml b/kubespray/project/roles/container-engine/docker/vars/redhat.yml index deead32..289453a 100644 --- a/kubespray/project/roles/container-engine/docker/vars/redhat.yml +++ b/kubespray/project/roles/container-engine/docker/vars/redhat.yml @@ -25,11 +25,20 @@ containerd_versioned_pkg: '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}" - 'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}" - 'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}" + '1.6.33': "{{ containerd_package }}-1.6.33-3.1.el{{ ansible_distribution_major_version }}" + '1.7.18': "{{ containerd_package }}-1.7.18-3.1.el{{ ansible_distribution_major_version }}" + '1.7.19': "{{ containerd_package }}-1.7.19-3.1.el{{ ansible_distribution_major_version }}" + '1.7.20': "{{ containerd_package }}-1.7.20-3.1.el{{ ansible_distribution_major_version }}" + '1.7.21': "{{ containerd_package }}-1.7.21-3.1.el{{ ansible_distribution_major_version }}" + '1.7.22': "{{ containerd_package }}-1.7.22-3.1.el{{ ansible_distribution_major_version }}" + '1.7.23': "{{ containerd_package }}-1.7.23-3.1.el{{ ansible_distribution_major_version }}" + '1.7.24': "{{ containerd_package }}-1.7.24-3.1.el{{ ansible_distribution_major_version }}" + '1.7.25': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}" + 'stable': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}" + 'edge': "{{ containerd_package }}-1.7.25-3.1.el{{ ansible_distribution_major_version }}" -# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package -# https://download.docker.com/linux/centos/>/x86_64/stable/Packages/ +# https://docs.docker.com/engine/installation/linux/rhel/#install-from-a-package +# https://download.docker.com/linux/rhel/>/x86_64/stable/Packages/ # or do 'yum --showduplicates list docker-engine' docker_versioned_pkg: 'latest': docker-ce @@ -39,9 +48,16 @@ docker_versioned_pkg: '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }} '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }} - '26.1': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }} - 'stable': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }} - 'edge': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }} + '26.1': docker-ce-3:26.1.4-1.el{{ ansible_distribution_major_version }} + '27.0': docker-ce-3:27.0.3-1.el{{ ansible_distribution_major_version }} + '27.1': docker-ce-3:27.1.3-1.el{{ ansible_distribution_major_version }} + '27.2': docker-ce-3:27.2.3-1.el{{ ansible_distribution_major_version }} + '27.3': docker-ce-3:27.3.3-1.el{{ ansible_distribution_major_version }} + '27.4': docker-ce-3:27.4.3-1.el{{ ansible_distribution_major_version }} + '27.5': docker-ce-3:27.5.3-1.el{{ ansible_distribution_major_version }} + '28.0': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }} + 'stable': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }} + 'edge': docker-ce-3:28.0.2-1.el{{ ansible_distribution_major_version }} docker_cli_versioned_pkg: 'latest': docker-ce-cli @@ -51,9 +67,16 @@ docker_cli_versioned_pkg: '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }} '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }} - '26.1': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }} - 'stable': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }} - 'edge': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }} + '26.1': docker-ce-cli-1:26.1.4-1.el{{ ansible_distribution_major_version }} + '27.0': docker-ce-cli-1:27.0.3-1.el{{ ansible_distribution_major_version }} + '27.1': docker-ce-cli-1:27.1.3-1.el{{ ansible_distribution_major_version }} + '27.2': docker-ce-cli-1:27.2.3-1.el{{ ansible_distribution_major_version }} + '27.3': docker-ce-cli-1:27.3.3-1.el{{ ansible_distribution_major_version }} + '27.4': docker-ce-cli-1:27.4.3-1.el{{ ansible_distribution_major_version }} + '27.5': docker-ce-cli-1:27.5.3-1.el{{ ansible_distribution_major_version }} + '28.0': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }} + 'stable': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }} + 'edge': docker-ce-cli-1:28.0.2-1.el{{ ansible_distribution_major_version }} docker_package_info: enablerepo: "docker-ce" diff --git a/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml b/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml index 636e417..1d4e7bb 100644 --- a/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml +++ b/kubespray/project/roles/container-engine/docker/vars/ubuntu.yml @@ -2,13 +2,6 @@ # containerd versions are only relevant for docker containerd_versioned_pkg: 'latest': "{{ containerd_package }}" - '1.3.7': "{{ containerd_package }}=1.3.7-1" - '1.3.9': "{{ containerd_package }}=1.3.9-1" - '1.4.3': "{{ containerd_package }}=1.4.3-2" - '1.4.4': "{{ containerd_package }}=1.4.4-1" - '1.4.6': "{{ containerd_package }}=1.4.6-1" - '1.4.9': "{{ containerd_package }}=1.4.9-1" - '1.4.12': "{{ containerd_package }}=1.4.12-1" '1.6.4': "{{ containerd_package }}=1.6.4-1" '1.6.6': "{{ containerd_package }}=1.6.6-1" '1.6.7': "{{ containerd_package }}=1.6.7-1" @@ -25,8 +18,17 @@ containerd_versioned_pkg: '1.6.28': "{{ containerd_package }}=1.6.28-2" '1.6.31': "{{ containerd_package }}=1.6.31-1" '1.6.32': "{{ containerd_package }}=1.6.32-1" - 'stable': "{{ containerd_package }}=1.6.32-1" - 'edge': "{{ containerd_package }}=1.6.32-1" + '1.6.33': "{{ containerd_package }}=1.6.33-1" + '1.7.18': "{{ containerd_package }}=1.7.18-1" + '1.7.19': "{{ containerd_package }}=1.7.19-1" + '1.7.20': "{{ containerd_package }}=1.7.20-1" + '1.7.21': "{{ containerd_package }}=1.7.21-1" + '1.7.22': "{{ containerd_package }}=1.7.22-1" + '1.7.23': "{{ containerd_package }}=1.7.23-1" + '1.7.24': "{{ containerd_package }}=1.7.24-1" + '1.7.25': "{{ containerd_package }}=1.7.25-1" + 'stable': "{{ containerd_package }}=1.7.25-1" + 'edge': "{{ containerd_package }}=1.7.25-1" # https://download.docker.com/linux/ubuntu/ docker_versioned_pkg: @@ -37,9 +39,16 @@ docker_versioned_pkg: '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} - '26.1': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} - 'stable': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} - 'edge': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '26.1': docker-ce=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.0': docker-ce=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.1': docker-ce=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.2': docker-ce=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.3': docker-ce=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.4': docker-ce=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.5': docker-ce=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '28.0': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + 'stable': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + 'edge': docker-ce=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} docker_cli_versioned_pkg: 'latest': docker-ce-cli @@ -49,9 +58,16 @@ docker_cli_versioned_pkg: '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} - '26.1': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} - 'stable': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} - 'edge': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '26.1': docker-ce-cli=5:26.1.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.0': docker-ce-cli=5:27.0.3-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.1': docker-ce-cli=5:27.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.2': docker-ce-cli=5:27.2.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.3': docker-ce-cli=5:27.3.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.4': docker-ce-cli=5:27.4.1-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '27.5': docker-ce-cli=5:27.5.4-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + '28.0': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + 'stable': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} + 'edge': docker-ce-cli=5:28.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} docker_package_info: pkgs: diff --git a/kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml b/kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml index b14d078..552a888 100644 --- a/kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml +++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/converge.yml @@ -6,6 +6,6 @@ gvisor_enabled: true container_manager: containerd roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: container-engine/containerd - role: container-engine/gvisor diff --git a/kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml b/kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml index 9ba1927..9bf4963 100644 --- a/kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml +++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/molecule.yml @@ -14,8 +14,8 @@ platforms: - kube_control_plane provider_options: driver: kvm - - name: almalinux8 - box: almalinux/8 + - name: almalinux9 + box: almalinux/9 cpus: 1 memory: 1024 nested: true diff --git a/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml b/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml index 57c21f2..0dc4e4e 100644 --- a/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml +++ b/kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml @@ -3,8 +3,8 @@ hosts: all become: true roles: - - role: kubespray-defaults - - role: bootstrap-os + - role: kubespray_defaults + - role: bootstrap_os - role: adduser user: "{{ addusers.kube }}" tasks: @@ -20,7 +20,7 @@ container_manager: containerd kube_network_plugin: cni roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: network_plugin/cni - role: container-engine/crictl tasks: diff --git a/kubespray/project/roles/container-engine/kata-containers/OWNERS b/kubespray/project/roles/container-engine/kata-containers/OWNERS deleted file mode 100644 index fa95926..0000000 --- a/kubespray/project/roles/container-engine/kata-containers/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - pasqualet -reviewers: - - pasqualet diff --git a/kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml b/kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml index a6fdf81..9a7922e 100644 --- a/kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml +++ b/kubespray/project/roles/container-engine/kata-containers/molecule/default/converge.yml @@ -6,6 +6,6 @@ kata_containers_enabled: true container_manager: containerd roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: container-engine/containerd - role: container-engine/kata-containers diff --git a/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml b/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml index a5abd27..8578e09 100644 --- a/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml +++ b/kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml @@ -3,8 +3,8 @@ hosts: all become: true roles: - - role: kubespray-defaults - - role: bootstrap-os + - role: kubespray_defaults + - role: bootstrap_os - role: adduser user: "{{ addusers.kube }}" tasks: @@ -20,7 +20,7 @@ container_manager: containerd kube_network_plugin: cni roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: network_plugin/cni - role: container-engine/crictl tasks: diff --git a/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml b/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml index ffb541c..c1e9d45 100644 --- a/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml +++ b/kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml @@ -84,7 +84,7 @@ block: - name: Drain node include_role: - name: remove-node/pre-remove + name: remove_node/pre_remove apply: tags: - pre-remove @@ -111,7 +111,7 @@ block: - name: Drain node include_role: - name: remove-node/pre-remove + name: remove_node/pre_remove apply: tags: - pre-remove @@ -137,7 +137,7 @@ block: - name: Drain node include_role: - name: remove-node/pre-remove + name: remove_node/pre_remove apply: tags: - pre-remove diff --git a/kubespray/project/roles/container-engine/youki/molecule/default/converge.yml b/kubespray/project/roles/container-engine/youki/molecule/default/converge.yml index 11ef8f6..caa6176 100644 --- a/kubespray/project/roles/container-engine/youki/molecule/default/converge.yml +++ b/kubespray/project/roles/container-engine/youki/molecule/default/converge.yml @@ -6,6 +6,6 @@ youki_enabled: true container_manager: crio roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: container-engine/cri-o - role: container-engine/youki diff --git a/kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml b/kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml index 9ba1927..9bf4963 100644 --- a/kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml +++ b/kubespray/project/roles/container-engine/youki/molecule/default/molecule.yml @@ -14,8 +14,8 @@ platforms: - kube_control_plane provider_options: driver: kvm - - name: almalinux8 - box: almalinux/8 + - name: almalinux9 + box: almalinux/9 cpus: 1 memory: 1024 nested: true diff --git a/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml b/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml index a72bdad..e6272ca 100644 --- a/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml +++ b/kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml @@ -3,8 +3,8 @@ hosts: all become: true roles: - - role: kubespray-defaults - - role: bootstrap-os + - role: kubespray_defaults + - role: bootstrap_os - role: adduser user: "{{ addusers.kube }}" tasks: @@ -20,7 +20,7 @@ container_manager: crio kube_network_plugin: cni roles: - - role: kubespray-defaults + - role: kubespray_defaults - role: network_plugin/cni - role: container-engine/crictl tasks: diff --git a/kubespray/project/roles/container-engine/youki/tasks/main.yml b/kubespray/project/roles/container-engine/youki/tasks/main.yml index 86182a3..7750c65 100644 --- a/kubespray/project/roles/container-engine/youki/tasks/main.yml +++ b/kubespray/project/roles/container-engine/youki/tasks/main.yml @@ -6,7 +6,7 @@ - name: Youki | Copy youki binary from download dir copy: - src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki" + src: "{{ local_release_dir }}/youki" dest: "{{ youki_bin_dir }}/youki" mode: "0755" remote_src: true diff --git a/kubespray/project/roles/download/tasks/download_file.yml b/kubespray/project/roles/download/tasks/download_file.yml index 53a7a81..c53f85c 100644 --- a/kubespray/project/roles/download/tasks/download_file.yml +++ b/kubespray/project/roles/download/tasks/download_file.yml @@ -7,7 +7,8 @@ set_fact: download_force_cache: "{{ true if download_run_once else download_force_cache }}" - - name: Download_file | Show url of file to dowload + - name: Download_file | Show url of file to download + when: unsafe_show_logs | bool debug: msg: "{{ download.url }}" run_once: "{{ download_run_once }}" @@ -61,7 +62,7 @@ dest: "{{ file_path_cached if download_force_cache else download.dest }}" owner: "{{ omit if download_localhost else (download.owner | default(omit)) }}" mode: "{{ omit if download_localhost else (download.mode | default(omit)) }}" - checksum: "{{ 'sha256:' + download.sha256 if download.sha256 else omit }}" + checksum: "{{ download.checksum }}" validate_certs: "{{ download_validate_certs }}" url_username: "{{ download.username | default(omit) }}" url_password: "{{ download.password | default(omit) }}" diff --git a/kubespray/project/roles/download/tasks/extract_file.yml b/kubespray/project/roles/download/tasks/extract_file.yml index ce7536f..fbe478c 100644 --- a/kubespray/project/roles/download/tasks/extract_file.yml +++ b/kubespray/project/roles/download/tasks/extract_file.yml @@ -5,7 +5,7 @@ dest: "{{ download.dest | dirname }}" owner: "{{ download.owner | default(omit) }}" mode: "{{ download.mode | default(omit) }}" - copy: false + remote_src: true extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}" when: - download.unarchive | default(false) diff --git a/kubespray/project/roles/download/tasks/main.yml b/kubespray/project/roles/download/tasks/main.yml index 3309ab8..93f8bb5 100644 --- a/kubespray/project/roles/download/tasks/main.yml +++ b/kubespray/project/roles/download/tasks/main.yml @@ -11,7 +11,7 @@ include_tasks: prep_kubeadm_images.yml when: - not skip_downloads | default(false) - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) tags: - download - upload diff --git a/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml b/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml index c1e8c6c..5c706d8 100644 --- a/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml +++ b/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml @@ -7,14 +7,6 @@ - not skip_downloads | default(false) - downloads.kubeadm.enabled -- name: Prep_kubeadm_images | Create kubeadm config - template: - src: "kubeadm-images.yaml.j2" - dest: "{{ kube_config_dir }}/kubeadm-images.yaml" - mode: "0644" - when: - - not skip_kubeadm_images | default(false) - - name: Prep_kubeadm_images | Copy kubeadm binary from download dir to system path copy: src: "{{ downloads.kubeadm.dest }}" @@ -22,11 +14,14 @@ mode: "0755" remote_src: true -- name: Prep_kubeadm_images | Set kubeadm binary permissions - file: - path: "{{ bin_dir }}/kubeadm" - mode: "0755" - state: file +- name: Prep_kubeadm_images | Create kubeadm config + template: + src: "kubeadm-images.yaml.j2" + dest: "{{ kube_config_dir }}/kubeadm-images.yaml" + mode: "0644" + validate: "{{ kubeadm_config_validate_enabled | ternary(bin_dir + '/kubeadm config validate --config %s', omit) }}" + when: + - not skip_kubeadm_images | default(false) - name: Prep_kubeadm_images | Generate list of required images shell: "set -o pipefail && {{ bin_dir }}/kubeadm config images list --config={{ kube_config_dir }}/kubeadm-images.yaml | grep -Ev 'coredns|pause'" @@ -49,7 +44,8 @@ container: true repo: "{{ item | regex_replace('^(.*):.*$', '\\1') }}" tag: "{{ item | regex_replace('^.*:(.*)$', '\\1') }}" - groups: k8s_cluster + groups: + - k8s_cluster loop: "{{ kubeadm_images_list | flatten(levels=1) }}" register: kubeadm_images_cooked run_once: true diff --git a/kubespray/project/roles/download/templates/kubeadm-images.yaml.j2 b/kubespray/project/roles/download/templates/kubeadm-images.yaml.j2 index 452e164..edf99cf 100644 --- a/kubespray/project/roles/download/templates/kubeadm-images.yaml.j2 +++ b/kubespray/project/roles/download/templates/kubeadm-images.yaml.j2 @@ -1,12 +1,12 @@ -apiVersion: kubeadm.k8s.io/v1beta3 +apiVersion: kubeadm.k8s.io/{{ kubeadm_config_api_version }} kind: InitConfiguration nodeRegistration: criSocket: {{ cri_socket }} --- -apiVersion: kubeadm.k8s.io/v1beta3 +apiVersion: kubeadm.k8s.io/{{ kubeadm_config_api_version }} kind: ClusterConfiguration imageRepository: {{ kube_image_repo }} -kubernetesVersion: {{ kube_version }} +kubernetesVersion: v{{ kube_version }} etcd: {% if etcd_deployment_type == "kubeadm" %} local: diff --git a/kubespray/project/roles/etcd/defaults/main.yml b/kubespray/project/roles/etcd/defaults/main.yml index 09ee9d6..784111b 100644 --- a/kubespray/project/roles/etcd/defaults/main.yml +++ b/kubespray/project/roles/etcd/defaults/main.yml @@ -34,8 +34,6 @@ etcd_script_dir: "{{ bin_dir }}/etcd-scripts" etcd_heartbeat_interval: "250" etcd_election_timeout: "5000" -# etcd_snapshot_count: "10000" - etcd_metrics: "basic" # Define in inventory to set a separate port for etcd to expose metrics on diff --git a/kubespray/project/roles/etcd/handlers/main.yml b/kubespray/project/roles/etcd/handlers/main.yml index 9c8b8a8..1d2205b 100644 --- a/kubespray/project/roles/etcd/handlers/main.yml +++ b/kubespray/project/roles/etcd/handlers/main.yml @@ -2,30 +2,29 @@ - name: Backup etcd import_tasks: backup.yml -- name: Etcd | reload systemd +- name: Restart etcd systemd_service: - daemon_reload: true - listen: - - Restart etcd - - Restart etcd-events - -- name: Reload etcd - service: name: etcd state: restarted - when: is_etcd_master - listen: Restart etcd + daemon_reload: true + when: ('etcd' in group_names) + throttle: "{{ groups['etcd'] | length // 2 }}" + # Etcd cluster MUST have an odd number of members + # Truncated integer division by 2 will always return (majority - 1) which + # means the cluster will keep quorum and stay available -- name: Reload etcd-events - service: +- name: Restart etcd-events + systemd_service: name: etcd-events state: restarted - when: is_etcd_master - listen: Restart etcd-events + daemon_reload: true + # TODO: this seems odd. etcd-events should be a different group possibly ? + when: ('etcd' in group_names) + throttle: "{{ groups['etcd'] | length // 2 }}" - name: Wait for etcd up uri: - url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2379/health" + url: "https://{% if 'etcd' in group_names %}{{ etcd_address | ansible.utils.ipwrap }}{% else %}127.0.0.1{% endif %}:2379/health" validate_certs: false client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem" client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem" @@ -40,7 +39,7 @@ - name: Wait for etcd-events up uri: - url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2383/health" + url: "https://{% if 'etcd' in group_names %}{{ etcd_address | ansible.utils.ipwrap }}{% else %}127.0.0.1{% endif %}:2383/health" validate_certs: false client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem" client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem" diff --git a/kubespray/project/roles/etcd/tasks/check_certs.yml b/kubespray/project/roles/etcd/tasks/check_certs.yml index 440685a..a4829b9 100644 --- a/kubespray/project/roles/etcd/tasks/check_certs.yml +++ b/kubespray/project/roles/etcd/tasks/check_certs.yml @@ -21,7 +21,7 @@ get_checksum: true get_mime: false register: etcd_member_certs - when: inventory_hostname in groups['etcd'] + when: ('etcd' in group_names) with_items: - ca.pem - member-{{ inventory_hostname }}.pem @@ -33,7 +33,7 @@ stat: path: "{{ etcd_cert_dir }}/{{ item }}" register: etcd_node_certs - when: inventory_hostname in groups['k8s_cluster'] + when: ('k8s_cluster' in group_names) with_items: - ca.pem - node-{{ inventory_hostname }}.pem @@ -84,7 +84,7 @@ {% if not loop.last %}{{ ',' }}{% endif %} {% endfor %}] when: - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" - force_etcd_cert_refresh or not item in etcdcert_master.files | map(attribute='path') | list @@ -99,7 +99,7 @@ set_fact: etcd_member_requires_sync: true when: - - inventory_hostname in groups['etcd'] + - ('etcd' in group_names) - (not etcd_member_certs.results[0].stat.exists | default(false)) or (not etcd_member_certs.results[1].stat.exists | default(false)) or (not etcd_member_certs.results[2].stat.exists | default(false)) or @@ -115,7 +115,7 @@ set_fact: kubernetes_host_requires_sync: true when: - - inventory_hostname in groups['k8s_cluster'] and + - ('k8s_cluster' in group_names) and inventory_hostname not in groups['etcd'] - (not etcd_node_certs.results[0].stat.exists | default(false)) or (not etcd_node_certs.results[1].stat.exists | default(false)) or diff --git a/kubespray/project/roles/etcd/tasks/configure.yml b/kubespray/project/roles/etcd/tasks/configure.yml index b7b943f..25629fa 100644 --- a/kubespray/project/roles/etcd/tasks/configure.yml +++ b/kubespray/project/roles/etcd/tasks/configure.yml @@ -9,7 +9,7 @@ check_mode: false run_once: true when: - - is_etcd_master + - ('etcd' in group_names) - etcd_cluster_setup tags: - facts @@ -30,7 +30,7 @@ check_mode: false run_once: true when: - - is_etcd_master + - ('etcd' in group_names) - etcd_events_cluster_setup tags: - facts @@ -43,7 +43,7 @@ - name: Configure | Refresh etcd config include_tasks: refresh_config.yml - when: is_etcd_master + when: ('etcd' in group_names) - name: Configure | Copy etcd.service systemd file template: @@ -54,7 +54,9 @@ # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release) # Remove once we drop support for systemd < 250 validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:etcd-{{ etcd_deployment_type }}.service'" - when: is_etcd_master and etcd_cluster_setup + when: + - ('etcd' in group_names) + - etcd_cluster_setup - name: Configure | Copy etcd-events.service systemd file template: @@ -65,12 +67,14 @@ validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:etcd-events-{{ etcd_deployment_type }}.service'" # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release) # Remove once we drop support for systemd < 250 - when: is_etcd_master and etcd_events_cluster_setup + when: + - ('etcd' in group_names) + - etcd_events_cluster_setup - name: Configure | reload systemd systemd_service: daemon_reload: true - when: is_etcd_master + when: ('etcd' in group_names) # when scaling new etcd will fail to start - name: Configure | Ensure etcd is running @@ -79,7 +83,9 @@ state: started enabled: true ignore_errors: "{{ etcd_cluster_is_healthy.rc == 0 }}" # noqa ignore-errors - when: is_etcd_master and etcd_cluster_setup + when: + - ('etcd' in group_names) + - etcd_cluster_setup # when scaling new etcd will fail to start - name: Configure | Ensure etcd-events is running @@ -88,7 +94,9 @@ state: started enabled: true ignore_errors: "{{ etcd_events_cluster_is_healthy.rc != 0 }}" # noqa ignore-errors - when: is_etcd_master and etcd_events_cluster_setup + when: + - ('etcd' in group_names) + - etcd_events_cluster_setup - name: Configure | Wait for etcd cluster to be healthy shell: "set -o pipefail && {{ bin_dir }}/etcdctl endpoint --cluster status && {{ bin_dir }}/etcdctl endpoint --cluster health 2>&1 | grep -v 'Error: unhealthy cluster' >/dev/null" @@ -102,7 +110,7 @@ check_mode: false run_once: true when: - - is_etcd_master + - ('etcd' in group_names) - etcd_cluster_setup tags: - facts @@ -125,7 +133,7 @@ check_mode: false run_once: true when: - - is_etcd_master + - ('etcd' in group_names) - etcd_events_cluster_setup tags: - facts @@ -137,12 +145,14 @@ ETCDCTL_ENDPOINTS: "{{ etcd_events_access_addresses }}" - name: Configure | Check if member is in etcd cluster - shell: "{{ bin_dir }}/etcdctl member list | grep -w -q {{ etcd_access_address }}" + shell: "{{ bin_dir }}/etcdctl member list | grep -w -q {{ etcd_access_address | replace('[', '') | replace(']', '') }}" register: etcd_member_in_cluster ignore_errors: true # noqa ignore-errors changed_when: false check_mode: false - when: is_etcd_master and etcd_cluster_setup + when: + - ('etcd' in group_names) + - etcd_cluster_setup tags: - facts environment: @@ -153,12 +163,14 @@ ETCDCTL_ENDPOINTS: "{{ etcd_access_addresses }}" - name: Configure | Check if member is in etcd-events cluster - shell: "{{ bin_dir }}/etcdctl member list | grep -w -q {{ etcd_access_address }}" + shell: "{{ bin_dir }}/etcdctl member list | grep -w -q {{ etcd_access_address | replace('[', '') | replace(']', '') }}" register: etcd_events_member_in_cluster ignore_errors: true # noqa ignore-errors changed_when: false check_mode: false - when: is_etcd_master and etcd_events_cluster_setup + when: + - ('etcd' in group_names) + - etcd_events_cluster_setup tags: - facts environment: diff --git a/kubespray/project/roles/etcd/tasks/gen_certs_script.yml b/kubespray/project/roles/etcd/tasks/gen_certs_script.yml index 934b5eb..71d12ee 100644 --- a/kubespray/project/roles/etcd/tasks/gen_certs_script.yml +++ b/kubespray/project/roles/etcd/tasks/gen_certs_script.yml @@ -35,7 +35,6 @@ mode: "0700" run_once: true when: - - gen_certs | default(false) - inventory_hostname == groups['etcd'][0] - name: Gen_certs | run cert generation script for etcd and kube control plane nodes @@ -55,7 +54,7 @@ run_once: true delegate_to: "{{ groups['etcd'][0] }}" when: - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" - gen_certs | default(false) notify: Set etcd_secret_changed @@ -79,7 +78,7 @@ {% endfor %}]" delegate_to: "{{ groups['etcd'][0] }}" when: - - inventory_hostname in groups['etcd'] + - ('etcd' in group_names) - sync_certs | default(false) - inventory_hostname != groups['etcd'][0] notify: Set etcd_secret_changed @@ -93,7 +92,7 @@ mode: "0640" with_items: "{{ etcd_master_certs.results }}" when: - - inventory_hostname in groups['etcd'] + - ('etcd' in group_names) - sync_certs | default(false) - inventory_hostname != groups['etcd'][0] loop_control: @@ -110,9 +109,9 @@ {% endfor %}]" delegate_to: "{{ groups['etcd'][0] }}" when: - - inventory_hostname in groups['etcd'] + - ('etcd' in group_names) - inventory_hostname != groups['etcd'][0] - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" notify: Set etcd_secret_changed @@ -125,9 +124,9 @@ mode: "0640" with_items: "{{ etcd_master_node_certs.results }}" when: - - inventory_hostname in groups['etcd'] + - ('etcd' in group_names) - inventory_hostname != groups['etcd'][0] - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" loop_control: label: "{{ item.item }}" @@ -135,15 +134,15 @@ - name: Gen_certs | Generate etcd certs include_tasks: gen_nodes_certs_script.yml when: - - inventory_hostname in groups['kube_control_plane'] and + - ('kube_control_plane' in group_names) and sync_certs | default(false) and inventory_hostname not in groups['etcd'] - name: Gen_certs | Generate etcd certs on nodes if needed include_tasks: gen_nodes_certs_script.yml when: - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" - - inventory_hostname in groups['k8s_cluster'] and + - ('k8s_cluster' in group_names) and sync_certs | default(false) and inventory_hostname not in groups['etcd'] - name: Gen_certs | check certificate permissions @@ -154,3 +153,25 @@ owner: "{{ etcd_owner }}" mode: "{{ etcd_cert_dir_mode }}" recurse: true + +# This is a hack around the fact kubeadm expect the same certs path on all kube_control_plane +# TODO: fix certs generation to have the same file everywhere +# OR work with kubeadm on node-specific config +- name: Gen_certs | Pretend all control plane have all certs (with symlinks) + file: + state: link + src: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}{{ item[0] }}.pem" + dest: "{{ etcd_cert_dir }}/node-{{ item[1] }}{{ item[0] }}.pem" + mode: "0640" + loop: "{{ suffixes | product(groups['kube_control_plane']) }}" + vars: + suffixes: + - '' + - '-key' + when: + - ('kube_control_plane' in group_names) + - item[1] != inventory_hostname + register: symlink_created + failed_when: + - symlink_created is failed + - ('refusing to convert from file to symlink' not in symlink_created.msg) diff --git a/kubespray/project/roles/etcd/tasks/install_host.yml b/kubespray/project/roles/etcd/tasks/install_host.yml index eb67952..8dca965 100644 --- a/kubespray/project/roles/etcd/tasks/install_host.yml +++ b/kubespray/project/roles/etcd/tasks/install_host.yml @@ -3,6 +3,7 @@ command: "{{ bin_dir }}/etcd --version" register: etcd_current_host_version # There's a chance this play could run before etcd is installed at all + # TODO: figure out whether this happens. "A chance" is not enough information ignore_errors: true when: etcd_cluster_setup @@ -11,18 +12,18 @@ notify: Restart etcd when: - etcd_cluster_setup - - etcd_version.lstrip('v') not in etcd_current_host_version.stdout | default('') + - etcd_version not in etcd_current_host_version.stdout | default('') - name: Restart etcd-events if necessary command: /bin/true notify: Restart etcd-events when: - etcd_events_cluster_setup - - etcd_version.lstrip('v') not in etcd_current_host_version.stdout | default('') + - etcd_version not in etcd_current_host_version.stdout | default('') - name: Install | Copy etcd binary from download dir copy: - src: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ host_architecture }}/{{ item }}" + src: "{{ local_release_dir }}/etcd-v{{ etcd_version }}-linux-{{ host_architecture }}/{{ item }}" dest: "{{ bin_dir }}/{{ item }}" mode: "0755" remote_src: true diff --git a/kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml b/kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml index 106f06e..6094202 100644 --- a/kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml +++ b/kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml @@ -19,7 +19,7 @@ etcd_events_peer_addresses: >- {% for host in groups['etcd'] -%} {%- if hostvars[host]['etcd_events_member_in_cluster'].rc == 0 -%} - {{ "etcd" + loop.index | string }}=https://{{ hostvars[host].etcd_events_access_address | default(hostvars[host].ip | default(fallback_ips[host])) }}:2382, + {{ "etcd" + loop.index | string }}="https://{{ hostvars[host].etcd_events_access_address | default(hostvars[host]['main_ip']) | ansible.utils.ipwrap }}:2382", {%- endif -%} {%- if loop.last -%} {{ etcd_member_name }}={{ etcd_events_peer_url }} diff --git a/kubespray/project/roles/etcd/tasks/join_etcd_member.yml b/kubespray/project/roles/etcd/tasks/join_etcd_member.yml index a2e3771..7d54e44 100644 --- a/kubespray/project/roles/etcd/tasks/join_etcd_member.yml +++ b/kubespray/project/roles/etcd/tasks/join_etcd_member.yml @@ -20,7 +20,7 @@ etcd_peer_addresses: >- {% for host in groups['etcd'] -%} {%- if hostvars[host]['etcd_member_in_cluster'].rc == 0 -%} - {{ "etcd" + loop.index | string }}=https://{{ hostvars[host].etcd_access_address | default(hostvars[host].ip | default(fallback_ips[host])) }}:2380, + {{ "etcd" + loop.index | string }}="https://{{ hostvars[host].etcd_access_address | default(hostvars[host]['main_ip']) | ansible.utils.ipwrap }}:2380", {%- endif -%} {%- if loop.last -%} {{ etcd_member_name }}={{ etcd_peer_url }} diff --git a/kubespray/project/roles/etcd/tasks/main.yml b/kubespray/project/roles/etcd/tasks/main.yml index 74d5f16..7e8c0f1 100644 --- a/kubespray/project/roles/etcd/tasks/main.yml +++ b/kubespray/project/roles/etcd/tasks/main.yml @@ -9,23 +9,23 @@ - name: Generate etcd certs include_tasks: "gen_certs_script.yml" when: - - cert_management | d('script') == "script" + - cert_management == "script" tags: - etcd-secrets - name: Trust etcd CA include_tasks: upd_ca_trust.yml when: - - inventory_hostname in groups['etcd'] | union(groups['kube_control_plane']) | unique | sort + - ('etcd' in group_names) or ('kube_control_plane' in group_names) tags: - etcd-secrets - name: Trust etcd CA on nodes if needed include_tasks: upd_ca_trust.yml when: - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) tags: - etcd-secrets @@ -35,22 +35,24 @@ changed_when: false check_mode: false when: - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) tags: - - master + - master # master tag is deprecated and replaced by control-plane + - control-plane - network - name: Set etcd_client_cert_serial set_fact: etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}" when: - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) tags: - - master + - master # master tag is deprecated and replaced by control-plane + - control-plane - network - name: Install etcdctl and etcdutl binary @@ -61,36 +63,42 @@ - etcdutl - upgrade when: - - inventory_hostname in groups['etcd'] + - ('etcd' in group_names) - etcd_cluster_setup - name: Install etcd include_tasks: "install_{{ etcd_deployment_type }}.yml" - when: is_etcd_master + when: ('etcd' in group_names) tags: - upgrade - name: Configure etcd include_tasks: configure.yml - when: is_etcd_master + when: ('etcd' in group_names) - name: Refresh etcd config include_tasks: refresh_config.yml - when: is_etcd_master + when: ('etcd' in group_names) - name: Restart etcd if certs changed command: /bin/true notify: Restart etcd - when: is_etcd_master and etcd_cluster_setup and etcd_secret_changed | default(false) + when: + - ('etcd' in group_names) + - etcd_cluster_setup + - etcd_secret_changed | default(false) - name: Restart etcd-events if certs changed command: /bin/true notify: Restart etcd - when: is_etcd_master and etcd_events_cluster_setup and etcd_secret_changed | default(false) + when: + - ('etcd' in group_names) + - etcd_events_cluster_setup + - etcd_secret_changed | default(false) # After etcd cluster is assembled, make sure that # initial state of the cluster is in `existing` # state instead of `new`. - name: Refresh etcd config again for idempotency include_tasks: refresh_config.yml - when: is_etcd_master + when: ('etcd' in group_names) diff --git a/kubespray/project/roles/etcd/tasks/refresh_config.yml b/kubespray/project/roles/etcd/tasks/refresh_config.yml index effebbd..ff0f8a6 100644 --- a/kubespray/project/roles/etcd/tasks/refresh_config.yml +++ b/kubespray/project/roles/etcd/tasks/refresh_config.yml @@ -5,7 +5,9 @@ dest: /etc/etcd.env mode: "0640" notify: Restart etcd - when: is_etcd_master and etcd_cluster_setup + when: + - ('etcd' in group_names) + - etcd_cluster_setup - name: Refresh config | Create etcd-events config file template: @@ -13,4 +15,6 @@ dest: /etc/etcd-events.env mode: "0640" notify: Restart etcd-events - when: is_etcd_master and etcd_events_cluster_setup + when: + - ('etcd' in group_names) + - etcd_events_cluster_setup diff --git a/kubespray/project/roles/etcd/templates/etcd-events.env.j2 b/kubespray/project/roles/etcd/templates/etcd-events.env.j2 index 3abefd6..1e576f5 100644 --- a/kubespray/project/roles/etcd/templates/etcd-events.env.j2 +++ b/kubespray/project/roles/etcd/templates/etcd-events.env.j2 @@ -4,11 +4,11 @@ ETCD_INITIAL_ADVERTISE_PEER_URLS={{ etcd_events_peer_url }} ETCD_INITIAL_CLUSTER_STATE={% if etcd_events_cluster_is_healthy.rc == 0 | bool %}existing{% else %}new{% endif %} ETCD_METRICS={{ etcd_metrics }} -ETCD_LISTEN_CLIENT_URLS=https://{{ etcd_address }}:2383,https://127.0.0.1:2383 +ETCD_LISTEN_CLIENT_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2383,https://127.0.0.1:2383 ETCD_ELECTION_TIMEOUT={{ etcd_election_timeout }} ETCD_HEARTBEAT_INTERVAL={{ etcd_heartbeat_interval }} ETCD_INITIAL_CLUSTER_TOKEN=k8s_events_etcd -ETCD_LISTEN_PEER_URLS=https://{{ etcd_address }}:2382 +ETCD_LISTEN_PEER_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2382 ETCD_NAME={{ etcd_member_name }}-events ETCD_PROXY=off ETCD_INITIAL_CLUSTER={{ etcd_events_peer_addresses }} diff --git a/kubespray/project/roles/etcd/templates/etcd.env.j2 b/kubespray/project/roles/etcd/templates/etcd.env.j2 index ec21795..3f7d39d 100644 --- a/kubespray/project/roles/etcd/templates/etcd.env.j2 +++ b/kubespray/project/roles/etcd/templates/etcd.env.j2 @@ -8,13 +8,13 @@ ETCD_METRICS={{ etcd_metrics }} {% if etcd_listen_metrics_urls is defined %} ETCD_LISTEN_METRICS_URLS={{ etcd_listen_metrics_urls }} {% elif etcd_metrics_port is defined %} -ETCD_LISTEN_METRICS_URLS=http://{{ etcd_address }}:{{ etcd_metrics_port }},http://127.0.0.1:{{ etcd_metrics_port }} +ETCD_LISTEN_METRICS_URLS=http://{{ etcd_address | ansible.utils.ipwrap }}:{{ etcd_metrics_port }},http://127.0.0.1:{{ etcd_metrics_port }} {% endif %} -ETCD_LISTEN_CLIENT_URLS=https://{{ etcd_address }}:2379,https://127.0.0.1:2379 +ETCD_LISTEN_CLIENT_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2379,https://127.0.0.1:2379 ETCD_ELECTION_TIMEOUT={{ etcd_election_timeout }} ETCD_HEARTBEAT_INTERVAL={{ etcd_heartbeat_interval }} ETCD_INITIAL_CLUSTER_TOKEN=k8s_etcd -ETCD_LISTEN_PEER_URLS=https://{{ etcd_address }}:2380 +ETCD_LISTEN_PEER_URLS=https://{{ etcd_address | ansible.utils.ipwrap }}:2380 ETCD_NAME={{ etcd_member_name }} ETCD_PROXY=off ETCD_INITIAL_CLUSTER={{ etcd_peer_addresses }} diff --git a/kubespray/project/roles/etcd/templates/openssl.conf.j2 b/kubespray/project/roles/etcd/templates/openssl.conf.j2 index b4a2d43..4186aaa 100644 --- a/kubespray/project/roles/etcd/templates/openssl.conf.j2 +++ b/kubespray/project/roles/etcd/templates/openssl.conf.j2 @@ -42,9 +42,16 @@ DNS.{{ counter["dns"] }} = {{ etcd_alt_name }}{{ increment(counter, 'dns') }} {% if hostvars[host]['access_ip'] is defined %} IP.{{ counter["ip"] }} = {{ hostvars[host]['access_ip'] }}{{ increment(counter, 'ip') }} {% endif %} -IP.{{ counter["ip"] }} = {{ hostvars[host]['ip'] | default(fallback_ips[host]) }}{{ increment(counter, 'ip') }} +{% if hostvars[host]['access_ip6'] is defined %} +IP.{{ counter["ip"] }} = {{ hostvars[host]['access_ip6'] }}{{ increment(counter, 'ip') }} +{% endif %} +{% if ipv6_stack %} +IP.{{ counter["ip"] }} = {{ hostvars[host]['ip6'] | default(hostvars[host]['fallback_ip6']) }}{{ increment(counter, 'ip') }} +{% endif %} +IP.{{ counter["ip"] }} = {{ hostvars[host]['main_ip'] }}{{ increment(counter, 'ip') }} {% endfor %} {% for cert_alt_ip in etcd_cert_alt_ips %} IP.{{ counter["ip"] }} = {{ cert_alt_ip }}{{ increment(counter, 'ip') }} {% endfor %} -IP.{{ counter["ip"] }} = 127.0.0.1 +IP.{{ counter["ip"] }} = 127.0.0.1{{ increment(counter, 'ip') }} +IP.{{ counter["ip"] }} = ::1 diff --git a/kubespray/project/roles/etcd/vars/main.yml b/kubespray/project/roles/etcd/vars/main.yml index 1e56904..9007e10 100644 --- a/kubespray/project/roles/etcd/vars/main.yml +++ b/kubespray/project/roles/etcd/vars/main.yml @@ -6,5 +6,5 @@ cert_files: - "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}.pem" - "{{ etcd_cert_dir }}/admin-{{ inventory_hostname }}-key.pem" node: - - "{{ etcd_cert_dir}}/node-{{ inventory_hostname }}.pem" - - "{{ etcd_cert_dir}}/node-{{ inventory_hostname }}-key.pem" + - "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem" + - "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem" diff --git a/kubespray/project/roles/etcdctl_etcdutl/tasks/main.yml b/kubespray/project/roles/etcdctl_etcdutl/tasks/main.yml index 053e142..cf4d4ea 100644 --- a/kubespray/project/roles/etcdctl_etcdutl/tasks/main.yml +++ b/kubespray/project/roles/etcdctl_etcdutl/tasks/main.yml @@ -29,7 +29,7 @@ - name: Copy etcdctl and etcdutl binary from download dir copy: - src: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ host_architecture }}/{{ item }}" + src: "{{ local_release_dir }}/etcd-v{{ etcd_version }}-linux-{{ host_architecture }}/{{ item }}" dest: "{{ bin_dir }}/{{ item }}" mode: "0755" remote_src: true diff --git a/kubespray/project/roles/helm-apps/meta/argument_specs.yml b/kubespray/project/roles/helm-apps/meta/argument_specs.yml index d1be9a8..0ec83bb 100644 --- a/kubespray/project/roles/helm-apps/meta/argument_specs.yml +++ b/kubespray/project/roles/helm-apps/meta/argument_specs.yml @@ -46,6 +46,9 @@ argument_specs: default: true wait_timeout: type: str + atomic: + type: bool + default: true repositories: type: list @@ -91,3 +94,6 @@ argument_specs: wait_timeout: type: str default: "5m" + atomic: + type: bool + default: true diff --git a/kubespray/project/roles/kubernetes-apps/ansible/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/ansible/defaults/main.yml index daebd07..9d27606 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/ansible/defaults/main.yml @@ -20,7 +20,7 @@ coredns_default_zone_cache_block: | coredns_pod_disruption_budget: false # value for coredns pdb coredns_pod_disruption_budget_max_unavailable: "30%" - +deploy_coredns: true # coredns_additional_configs adds any extra configuration to coredns # coredns_additional_configs: | # whoami @@ -55,11 +55,17 @@ nodelocaldns_ds_nodeselector: "kubernetes.io/os: linux" nodelocaldns_prometheus_port: 9253 nodelocaldns_secondary_prometheus_port: 9255 +# nodelocaldns_additional_configs adds any extra configuration to coredns +# nodelocaldns_additional_configs: | +# whoami +# local + # Limits for dns-autoscaler dns_autoscaler_cpu_requests: 20m dns_autoscaler_memory_requests: 10Mi dns_autoscaler_deployment_nodeselector: "kubernetes.io/os: linux" # dns_autoscaler_extra_tolerations: [{effect: NoSchedule, operator: "Exists"}] +dns_autoscaler_affinity: {} # etcd metrics # etcd_metrics_service_labels: diff --git a/kubespray/project/roles/kubernetes-apps/ansible/tasks/coredns.yml b/kubespray/project/roles/kubernetes-apps/ansible/tasks/coredns.yml deleted file mode 100644 index 46e2006..0000000 --- a/kubespray/project/roles/kubernetes-apps/ansible/tasks/coredns.yml +++ /dev/null @@ -1,50 +0,0 @@ ---- -- name: Kubernetes Apps | Lay Down CoreDNS templates - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - loop: - - { name: coredns, file: coredns-clusterrole.yml, type: clusterrole } - - { name: coredns, file: coredns-clusterrolebinding.yml, type: clusterrolebinding } - - { name: coredns, file: coredns-config.yml, type: configmap } - - { name: coredns, file: coredns-deployment.yml, type: deployment } - - { name: coredns, file: coredns-sa.yml, type: sa } - - { name: coredns, file: coredns-svc.yml, type: svc } - - { name: dns-autoscaler, file: dns-autoscaler.yml, type: deployment } - - { name: dns-autoscaler, file: dns-autoscaler-clusterrole.yml, type: clusterrole } - - { name: dns-autoscaler, file: dns-autoscaler-clusterrolebinding.yml, type: clusterrolebinding } - - { name: coredns, file: coredns-poddisruptionbudget.yml, type: poddisruptionbudget, condition: coredns_pod_disruption_budget } - - { name: dns-autoscaler, file: dns-autoscaler-sa.yml, type: sa } - register: coredns_manifests - vars: - clusterIP: "{{ skydns_server }}" - when: - - dns_mode in ['coredns', 'coredns_dual'] - - inventory_hostname == groups['kube_control_plane'][0] - - enable_dns_autoscaler or item.name != 'dns-autoscaler' - - item.condition | default(True) - tags: - - coredns - -- name: Kubernetes Apps | Lay Down Secondary CoreDNS Template - template: - src: "{{ item.src }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: - - { name: coredns, src: coredns-deployment.yml, file: coredns-deployment-secondary.yml, type: deployment } - - { name: coredns, src: coredns-svc.yml, file: coredns-svc-secondary.yml, type: svc } - - { name: dns-autoscaler, src: dns-autoscaler.yml, file: coredns-autoscaler-secondary.yml, type: deployment } - - { name: coredns, src: coredns-poddisruptionbudget.yml, file: coredns-poddisruptionbudget-secondary.yml, type: poddisruptionbudget, condition: coredns_pod_disruption_budget } - register: coredns_secondary_manifests - vars: - clusterIP: "{{ skydns_server_secondary }}" - coredns_ordinal_suffix: "-secondary" - when: - - dns_mode == 'coredns_dual' - - inventory_hostname == groups['kube_control_plane'][0] - - enable_dns_autoscaler or item.name != 'dns-autoscaler' - - item.condition | default(True) - tags: - - coredns diff --git a/kubespray/project/roles/kubernetes-apps/ansible/tasks/dashboard.yml b/kubespray/project/roles/kubernetes-apps/ansible/tasks/dashboard.yml deleted file mode 100644 index 5872674..0000000 --- a/kubespray/project/roles/kubernetes-apps/ansible/tasks/dashboard.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -- name: Kubernetes Apps | Lay down dashboard template - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: - - { file: dashboard.yml, type: deploy, name: kubernetes-dashboard } - register: manifests - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: Kubernetes Apps | Start dashboard - kube: - name: "{{ item.item.name }}" - namespace: "{{ dashboard_namespace }}" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/{{ item.item.file }}" - state: "latest" - with_items: "{{ manifests.results }}" - when: inventory_hostname == groups['kube_control_plane'][0] diff --git a/kubespray/project/roles/kubernetes-apps/ansible/tasks/etcd_metrics.yml b/kubespray/project/roles/kubernetes-apps/ansible/tasks/etcd_metrics.yml deleted file mode 100644 index 580ab66..0000000 --- a/kubespray/project/roles/kubernetes-apps/ansible/tasks/etcd_metrics.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -- name: Kubernetes Apps | Lay down etcd_metrics templates - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: - - { file: etcd_metrics-endpoints.yml, type: endpoints, name: etcd-metrics } - - { file: etcd_metrics-service.yml, type: service, name: etcd-metrics } - register: manifests - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: Kubernetes Apps | Start etcd_metrics - kube: - name: "{{ item.item.name }}" - namespace: kube-system - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/{{ item.item.file }}" - state: "latest" - with_items: "{{ manifests.results }}" - when: inventory_hostname == groups['kube_control_plane'][0] diff --git a/kubespray/project/roles/kubernetes-apps/ansible/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/ansible/tasks/main.yml index 18deee8..5b24d11 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/tasks/main.yml +++ b/kubespray/project/roles/kubernetes-apps/ansible/tasks/main.yml @@ -12,62 +12,112 @@ when: inventory_hostname == groups['kube_control_plane'][0] - name: Kubernetes Apps | CoreDNS - import_tasks: "coredns.yml" + command: + cmd: "{{ kubectl_apply_stdin }}" + stdin: "{{ lookup('template', item) }}" + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true + loop: "{{ coredns_manifests | flatten }}" + tags: + - coredns + vars: + clusterIP: "{{ skydns_server }}" when: - dns_mode in ['coredns', 'coredns_dual'] - - inventory_hostname == groups['kube_control_plane'][0] + - deploy_coredns + +- name: Kubernetes Apps | CoreDNS Secondary + command: + cmd: "{{ kubectl_apply_stdin }}" + stdin: "{{ lookup('template', item) }}" + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true + loop: "{{ coredns_manifests | flatten }}" tags: - coredns + vars: + clusterIP: "{{ skydns_server_secondary }}" + coredns_ordinal_suffix: "-secondary" + when: + - dns_mode == 'coredns_dual' + - deploy_coredns - name: Kubernetes Apps | nodelocalDNS - import_tasks: "nodelocaldns.yml" + command: + cmd: "{{ kubectl_apply_stdin }}" + stdin: "{{ lookup('template', item) }}" + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true + loop: "{{ nodelocaldns_manifests | flatten }}" when: - enable_nodelocaldns - - inventory_hostname == groups['kube_control_plane'] | first tags: - nodelocaldns - -- name: Kubernetes Apps | Start Resources - kube: - name: "{{ item.item.name }}" - namespace: "kube-system" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/{{ item.item.file }}" - state: "latest" - with_items: - - "{{ coredns_manifests.results | default({}) }}" - - "{{ coredns_secondary_manifests.results | default({}) }}" - - "{{ nodelocaldns_manifests.results | default({}) }}" - - "{{ nodelocaldns_second_manifests.results | default({}) }}" - when: - - dns_mode != 'none' - - inventory_hostname == groups['kube_control_plane'][0] - - not item is skipped - register: resource_result - until: resource_result is succeeded - retries: 4 - delay: 5 - tags: - coredns - - nodelocaldns - loop_control: - label: "{{ item.item.file }}" + vars: + primaryClusterIP: >- + {%- if dns_mode in ['coredns', 'coredns_dual'] -%} + {{ skydns_server }} + {%- elif dns_mode == 'manual' -%} + {{ manual_dns_server }} + {%- endif -%} + secondaryclusterIP: "{{ skydns_server_secondary }}" + forwardTarget: >- + {%- if secondaryclusterIP is defined and dns_mode == 'coredns_dual' -%} + {{ primaryClusterIP }} {{ secondaryclusterIP }} + {%- else -%} + {{ primaryClusterIP }} + {%- endif -%} + upstreamForwardTarget: >- + {%- if upstream_dns_servers | length > 0 -%} + {{ upstream_dns_servers | join(' ') }} + {%- else -%} + /etc/resolv.conf + {%- endif -%} - name: Kubernetes Apps | Etcd metrics endpoints - import_tasks: etcd_metrics.yml + command: + cmd: "{{ kubectl_apply_stdin }}" + stdin: "{{ lookup('template', item) }}" + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true + loop: + - etcd_metrics-endpoints.yml.j2 + - etcd_metrics-service.yml.j2 when: etcd_metrics_port is defined and etcd_metrics_service_labels is defined tags: - etcd_metrics - name: Kubernetes Apps | Netchecker - import_tasks: netchecker.yml + command: + cmd: "{{ kubectl_apply_stdin }}" + stdin: "{{ lookup('template', item) }}" + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true + vars: + namespace: "{{ netcheck_namespace }}" when: deploy_netchecker tags: - netchecker + loop: + - netchecker-ns.yml.j2 + - netchecker-agent-sa.yml.j2 + - netchecker-agent-ds.yml.j2 + - netchecker-agent-hostnet-ds.yml.j2 + - netchecker-server-sa.yml.j2 + - netchecker-server-clusterrole.yml.j2 + - netchecker-server-clusterrolebinding.yml.j2 + - netchecker-server-deployment.yml.j2 + - netchecker-server-svc.yml.j2 - name: Kubernetes Apps | Dashboard - import_tasks: dashboard.yml + command: + cmd: "{{ kubectl_apply_stdin }}" + stdin: "{{ lookup('template', 'dashboard.yml.j2') }}" + delegate_to: "{{ groups['kube_control_plane'][0] }}" + run_once: true + vars: + namespace: "{{ dashboard_namespace }}" when: dashboard_enabled tags: - dashboard diff --git a/kubespray/project/roles/kubernetes-apps/ansible/tasks/netchecker.yml b/kubespray/project/roles/kubernetes-apps/ansible/tasks/netchecker.yml deleted file mode 100644 index 2cf4b5d..0000000 --- a/kubespray/project/roles/kubernetes-apps/ansible/tasks/netchecker.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -- name: Kubernetes Apps | Check AppArmor status - command: which apparmor_parser - register: apparmor_status - when: - - inventory_hostname == groups['kube_control_plane'][0] - failed_when: false - -- name: Kubernetes Apps | Set apparmor_enabled - set_fact: - apparmor_enabled: "{{ apparmor_status.rc == 0 }}" - when: - - inventory_hostname == groups['kube_control_plane'][0] - -- name: Kubernetes Apps | Netchecker Templates list - set_fact: - netchecker_templates: - - {file: netchecker-ns.yml, type: ns, name: netchecker-namespace} - - {file: netchecker-agent-sa.yml, type: sa, name: netchecker-agent} - - {file: netchecker-agent-ds.yml, type: ds, name: netchecker-agent} - - {file: netchecker-agent-hostnet-ds.yml, type: ds, name: netchecker-agent-hostnet} - - {file: netchecker-server-sa.yml, type: sa, name: netchecker-server} - - {file: netchecker-server-clusterrole.yml, type: clusterrole, name: netchecker-server} - - {file: netchecker-server-clusterrolebinding.yml, type: clusterrolebinding, name: netchecker-server} - - {file: netchecker-server-deployment.yml, type: deployment, name: netchecker-server} - - {file: netchecker-server-svc.yml, type: svc, name: netchecker-service} - -- name: Kubernetes Apps | Lay Down Netchecker Template - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: "{{ netchecker_templates }}" - register: manifests - when: - - inventory_hostname == groups['kube_control_plane'][0] - -- name: Kubernetes Apps | Start Netchecker Resources - kube: - name: "{{ item.item.name }}" - namespace: "{{ netcheck_namespace }}" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/{{ item.item.file }}" - state: "latest" - with_items: "{{ manifests.results }}" - when: inventory_hostname == groups['kube_control_plane'][0] and not item is skipped diff --git a/kubespray/project/roles/kubernetes-apps/ansible/tasks/nodelocaldns.yml b/kubespray/project/roles/kubernetes-apps/ansible/tasks/nodelocaldns.yml deleted file mode 100644 index 7e522e2..0000000 --- a/kubespray/project/roles/kubernetes-apps/ansible/tasks/nodelocaldns.yml +++ /dev/null @@ -1,79 +0,0 @@ ---- -- name: Kubernetes Apps | set up necessary nodelocaldns parameters - set_fact: - # noqa: jinja[spacing] - primaryClusterIP: >- - {%- if dns_mode in ['coredns', 'coredns_dual'] -%} - {{ skydns_server }} - {%- elif dns_mode == 'manual' -%} - {{ manual_dns_server }} - {%- endif -%} - secondaryclusterIP: "{{ skydns_server_secondary }}" - when: - - enable_nodelocaldns - - inventory_hostname == groups['kube_control_plane'] | first - tags: - - nodelocaldns - - coredns - -- name: Kubernetes Apps | Lay Down nodelocaldns Template - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: - - { name: nodelocaldns, file: nodelocaldns-config.yml, type: configmap } - - { name: nodelocaldns, file: nodelocaldns-sa.yml, type: sa } - - { name: nodelocaldns, file: nodelocaldns-daemonset.yml, type: daemonset } - register: nodelocaldns_manifests - vars: - # noqa: jinja[spacing] - forwardTarget: >- - {%- if secondaryclusterIP is defined and dns_mode == 'coredns_dual' -%} - {{ primaryClusterIP }} {{ secondaryclusterIP }} - {%- else -%} - {{ primaryClusterIP }} - {%- endif -%} - upstreamForwardTarget: >- - {%- if upstream_dns_servers is defined and upstream_dns_servers | length > 0 -%} - {{ upstream_dns_servers | join(' ') }} - {%- else -%} - /etc/resolv.conf - {%- endif -%} - when: - - enable_nodelocaldns - - inventory_hostname == groups['kube_control_plane'] | first - tags: - - nodelocaldns - - coredns - -- name: Kubernetes Apps | Lay Down nodelocaldns-secondary Template - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: - - { name: nodelocaldns, file: nodelocaldns-second-daemonset.yml, type: daemonset } - register: nodelocaldns_second_manifests - vars: - # noqa: jinja[spacing] - forwardTarget: >- - {%- if secondaryclusterIP is defined and dns_mode == 'coredns_dual' -%} - {{ primaryClusterIP }} {{ secondaryclusterIP }} - {%- else -%} - {{ primaryClusterIP }} - {%- endif -%} - # noqa: jinja[spacing] - upstreamForwardTarget: >- - {%- if upstream_dns_servers is defined and upstream_dns_servers | length > 0 -%} - {{ upstream_dns_servers | join(' ') }} - {%- else -%} - /etc/resolv.conf - {%- endif -%} - when: - - enable_nodelocaldns - - enable_nodelocaldns_secondary - - inventory_hostname == groups['kube_control_plane'] | first - tags: - - nodelocaldns - - coredns diff --git a/kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2 b/kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2 index 8a48119..7671c0c 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2 @@ -68,12 +68,14 @@ data: {% endif %} } prometheus :9153 - forward . {{ upstream_dns_servers | join(' ') if upstream_dns_servers is defined and upstream_dns_servers | length > 0 else '/etc/resolv.conf' }} { + forward . {{ upstream_dns_servers | join(' ') if upstream_dns_servers | length > 0 else '/etc/resolv.conf' }} { prefer_udp max_concurrent 1000 {% if dns_upstream_forward_extra_opts is defined %} {% for optname, optvalue in dns_upstream_forward_extra_opts.items() %} - {{ optname }} {{ optvalue }} + {{ (optname ~ ' ' ~ optvalue) | trim }} + {# do not add a trailing space when optvalue == '' + workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #} {% endfor %} {% endif %} } diff --git a/kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 b/kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 index e0b60e7..3a88010 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 @@ -17,16 +17,15 @@ # # Example usage: kubectl create -f -{% if dashboard_namespace != "kube-system" %} +{% if namespace != 'kube-system' %} --- apiVersion: v1 kind: Namespace metadata: - name: {{ dashboard_namespace }} + name: {{ namespace }} labels: - name: {{ dashboard_namespace }} + name: {{ namespace }} {% endif %} - --- # ------------------- Dashboard Secrets ------------------- # apiVersion: v1 @@ -35,7 +34,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-certs - namespace: {{ dashboard_namespace }} type: Opaque --- @@ -45,7 +43,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-csrf - namespace: {{ dashboard_namespace }} type: Opaque data: csrf: "" @@ -57,7 +54,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-key-holder - namespace: {{ dashboard_namespace }} type: Opaque --- @@ -68,7 +64,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard-settings - namespace: {{ dashboard_namespace }} --- # ------------------- Dashboard Service Account ------------------- # @@ -79,7 +74,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} --- # ------------------- Dashboard Role & Role Binding ------------------- # @@ -89,7 +83,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} rules: # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: [""] @@ -118,7 +111,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -126,7 +118,7 @@ roleRef: subjects: - kind: ServiceAccount name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} + namespace: {{ namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 @@ -140,7 +132,7 @@ roleRef: subjects: - kind: ServiceAccount name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} + namespace: {{ namespace }} --- # ------------------- Dashboard Deployment ------------------- # @@ -151,7 +143,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} spec: replicas: {{ dashboard_replicas }} revisionHistoryLimit: 10 @@ -182,7 +173,7 @@ spec: - containerPort: 8443 protocol: TCP args: - - --namespace={{ dashboard_namespace }} + - --namespace={{ namespace }} {% if dashboard_use_custom_certs %} - --tls-key-file={{ dashboard_tls_key_file }} - --tls-cert-file={{ dashboard_tls_cert_file }} @@ -238,7 +229,6 @@ metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard - namespace: {{ dashboard_namespace }} spec: ports: - port: 443 @@ -270,7 +260,6 @@ metadata: labels: k8s-app: kubernetes-metrics-scraper name: dashboard-metrics-scraper - namespace: {{ dashboard_namespace }} spec: ports: - port: 8000 @@ -287,7 +276,6 @@ metadata: labels: k8s-app: kubernetes-metrics-scraper name: kubernetes-metrics-scraper - namespace: {{ dashboard_namespace }} spec: replicas: 1 revisionHistoryLimit: 10 diff --git a/kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2 b/kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2 index c10ebf9..0f8afce 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2 @@ -48,21 +48,7 @@ spec: {{ dns_autoscaler_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }} {% endif %} affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - topologyKey: "kubernetes.io/hostname" - labelSelector: - matchLabels: - k8s-app: dns-autoscaler{{ coredns_ordinal_suffix }} - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: node-role.kubernetes.io/control-plane - operator: In - values: - - "" + {{ dns_autoscaler_affinity | to_nice_yaml(indent=2) | indent(8) }} containers: - name: autoscaler image: "{{ dnsautoscaler_image_repo }}:{{ dnsautoscaler_image_tag }}" diff --git a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2 b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2 index e8ce545..1a91f11 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2 @@ -75,6 +75,9 @@ data: prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_prometheus_port }} } .:53 { +{% if nodelocaldns_additional_configs is defined %} + {{ nodelocaldns_additional_configs | indent(width=8, first=False) }} +{% endif %} errors cache 30 reload @@ -82,7 +85,9 @@ data: bind {{ nodelocaldns_ip }} forward . {{ upstreamForwardTarget }}{% if dns_upstream_forward_extra_opts is defined %} { {% for optname, optvalue in dns_upstream_forward_extra_opts.items() %} - {{ optname }} {{ optvalue }} + {{ (optname ~ ' ' ~ optvalue) | trim }} + {# do not add a trailing space when optvalue == '' + workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #} {% endfor %} }{% endif %} @@ -157,6 +162,9 @@ data: prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_secondary_prometheus_port }} } .:53 { +{% if nodelocaldns_additional_configs is defined %} + {{ nodelocaldns_additional_configs | indent(width=8, first=False) }} +{% endif %} errors cache 30 reload @@ -164,7 +172,9 @@ data: bind {{ nodelocaldns_ip }} forward . {{ upstreamForwardTarget }}{% if dns_upstream_forward_extra_opts is defined %} { {% for optname, optvalue in dns_upstream_forward_extra_opts.items() %} - {{ optname }} {{ optvalue }} + {{ (optname ~ ' ' ~ optvalue) | trim }} + {# do not add a trailing space when optvalue == '' + workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #} {% endfor %} }{% endif %} diff --git a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2 b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2 index 6e1dda3..723243b 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2 @@ -47,7 +47,7 @@ spec: - coredns {% if enable_nodelocaldns_secondary %} - -skipteardown -{% else %} +{% endif %} ports: - containerPort: 53 name: dns @@ -55,10 +55,9 @@ spec: - containerPort: 53 name: dns-tcp protocol: TCP - - containerPort: 9253 + - containerPort: {{ nodelocaldns_prometheus_port }} name: metrics protocol: TCP -{% endif %} securityContext: privileged: true {% if nodelocaldns_bind_metrics_host_ip %} diff --git a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2 b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2 index df9405e..76eecef 100644 --- a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2 @@ -39,6 +39,10 @@ spec: cpu: {{ nodelocaldns_cpu_requests }} memory: {{ nodelocaldns_memory_requests }} args: [ "-localip", "{{ nodelocaldns_ip }}", "-conf", "/etc/coredns/Corefile", "-upstreamsvc", "coredns", "-skipteardown" ] + ports: + - containerPort: {{ nodelocaldns_secondary_prometheus_port }} + name: metrics + protocol: TCP securityContext: privileged: true {% if nodelocaldns_bind_metrics_host_ip %} diff --git a/kubespray/project/roles/kubernetes-apps/ansible/vars/main.yml b/kubespray/project/roles/kubernetes-apps/ansible/vars/main.yml new file mode 100644 index 0000000..f71c652 --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/ansible/vars/main.yml @@ -0,0 +1,22 @@ +--- +dns_autoscaler_manifests: +- dns-autoscaler-sa.yml.j2 +- dns-autoscaler.yml.j2 +- dns-autoscaler-clusterrole.yml.j2 +- dns-autoscaler-clusterrolebinding.yml.j2 + +coredns_manifests: +- coredns-clusterrole.yml.j2 +- coredns-clusterrolebinding.yml.j2 +- coredns-config.yml.j2 +- coredns-deployment.yml.j2 +- coredns-sa.yml.j2 +- coredns-svc.yml.j2 +- "{{ dns_autoscaler_manifests if enable_dns_autoscaler else [] }}" +- "{{ 'coredns-poddisruptionbudget.yml.j2' if coredns_pod_disruption_budget else [] }}" + +nodelocaldns_manifests: +- nodelocaldns-config.yml.j2 +- nodelocaldns-daemonset.yml.j2 +- nodelocaldns-sa.yml.j2 +- "{{ 'nodelocaldns-second-daemonset.yml.j2' if enable_nodelocaldns_secondary else [] }}" diff --git a/kubespray/project/roles/kubernetes-apps/argocd/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/argocd/defaults/main.yml index b164b62..a12129f 100644 --- a/kubespray/project/roles/kubernetes-apps/argocd/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/argocd/defaults/main.yml @@ -1,6 +1,6 @@ --- argocd_enabled: false -argocd_version: v2.11.0 +argocd_version: 2.14.5 argocd_namespace: argocd # argocd_admin_password: -argocd_install_url: "https://raw.githubusercontent.com/argoproj/argo-cd/{{ argocd_version }}/manifests/install.yaml" +argocd_install_url: "https://raw.githubusercontent.com/argoproj/argo-cd/v{{ argocd_version }}/manifests/install.yaml" diff --git a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/defaults/main.yml deleted file mode 100644 index 9d7ddf0..0000000 --- a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/defaults/main.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- - -oci_security_list_management: All -oci_use_instance_principals: false -oci_cloud_controller_version: 0.7.0 -oci_cloud_controller_pull_source: iad.ocir.io/oracle/cloud-provider-oci diff --git a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/credentials-check.yml b/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/credentials-check.yml deleted file mode 100644 index 9eb8794..0000000 --- a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/credentials-check.yml +++ /dev/null @@ -1,67 +0,0 @@ ---- - -- name: "OCI Cloud Controller | Credentials Check | oci_private_key" - fail: - msg: "oci_private_key is missing" - when: - - not oci_use_instance_principals - - oci_private_key is not defined or not oci_private_key - -- name: "OCI Cloud Controller | Credentials Check | oci_region_id" - fail: - msg: "oci_region_id is missing" - when: - - not oci_use_instance_principals - - oci_region_id is not defined or not oci_region_id - -- name: "OCI Cloud Controller | Credentials Check | oci_tenancy_id" - fail: - msg: "oci_tenancy_id is missing" - when: - - not oci_use_instance_principals - - oci_tenancy_id is not defined or not oci_tenancy_id - -- name: "OCI Cloud Controller | Credentials Check | oci_user_id" - fail: - msg: "oci_user_id is missing" - when: - - not oci_use_instance_principals - - oci_user_id is not defined or not oci_user_id - -- name: "OCI Cloud Controller | Credentials Check | oci_user_fingerprint" - fail: - msg: "oci_user_fingerprint is missing" - when: - - not oci_use_instance_principals - - oci_user_fingerprint is not defined or not oci_user_fingerprint - -- name: "OCI Cloud Controller | Credentials Check | oci_compartment_id" - fail: - msg: "oci_compartment_id is missing. This is the compartment in which the cluster resides" - when: - - oci_compartment_id is not defined or not oci_compartment_id - -- name: "OCI Cloud Controller | Credentials Check | oci_vnc_id" - fail: - msg: "oci_vnc_id is missing. This is the Virtual Cloud Network in which the cluster resides" - when: - - oci_vnc_id is not defined or not oci_vnc_id - -- name: "OCI Cloud Controller | Credentials Check | oci_subnet1_id" - fail: - msg: "oci_subnet1_id is missingg. This is the first subnet to which loadbalancers will be added" - when: - - oci_subnet1_id is not defined or not oci_subnet1_id - -- name: "OCI Cloud Controller | Credentials Check | oci_subnet2_id" - fail: - msg: "oci_subnet2_id is missing. Two subnets are required for load balancer high availability" - when: - - oci_cloud_controller_version is version_compare('0.7.0', '<') - - oci_subnet2_id is not defined or not oci_subnet2_id - -- name: "OCI Cloud Controller | Credentials Check | oci_security_list_management" - fail: - msg: "oci_security_list_management is missing, or not defined correctly. Valid options are (All, Frontend, None)." - when: - - oci_security_list_management is not defined or oci_security_list_management not in ["All", "Frontend", "None"] diff --git a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml deleted file mode 100644 index a5913ec..0000000 --- a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml +++ /dev/null @@ -1,35 +0,0 @@ ---- - -- name: OCI Cloud Controller | Check Oracle Cloud credentials - import_tasks: credentials-check.yml - -- name: "OCI Cloud Controller | Generate Cloud Provider Configuration" - template: - src: controller-manager-config.yml.j2 - dest: "{{ kube_config_dir }}/controller-manager-config.yml" - mode: "0644" - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: "OCI Cloud Controller | Slurp Configuration" - slurp: - src: "{{ kube_config_dir }}/controller-manager-config.yml" - register: controller_manager_config - -- name: "OCI Cloud Controller | Encode Configuration" - set_fact: - controller_manager_config_base64: "{{ controller_manager_config.content }}" - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: "OCI Cloud Controller | Generate Manifests" - template: - src: oci-cloud-provider.yml.j2 - dest: "{{ kube_config_dir }}/oci-cloud-provider.yml" - mode: "0644" - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: "OCI Cloud Controller | Apply Manifests" - kube: - kubectl: "{{ bin_dir }}/kubectl" - filename: "{{ kube_config_dir }}/oci-cloud-provider.yml" - state: latest - when: inventory_hostname == groups['kube_control_plane'][0] diff --git a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/controller-manager-config.yml.j2 b/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/controller-manager-config.yml.j2 deleted file mode 100644 index d585de1..0000000 --- a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/controller-manager-config.yml.j2 +++ /dev/null @@ -1,89 +0,0 @@ -{% macro private_key() %}{{ oci_private_key }}{% endmacro %} - -{% if oci_use_instance_principals %} - # (https://docs.us-phoenix-1.oraclecloud.com/Content/Identity/Tasks/callingservicesfrominstances.htm). - # Ensure you have setup the following OCI policies and your kubernetes nodes are running within them - # allow dynamic-group [your dynamic group name] to read instance-family in compartment [your compartment name] - # allow dynamic-group [your dynamic group name] to use virtual-network-family in compartment [your compartment name] - # allow dynamic-group [your dynamic group name] to manage load-balancers in compartment [your compartment name] -useInstancePrincipals: true -{% else %} -useInstancePrincipals: false -{% endif %} - -auth: - -{% if oci_use_instance_principals %} - # This key is put here too for backwards compatibility - useInstancePrincipals: true -{% else %} - useInstancePrincipals: false - - region: {{ oci_region_id }} - tenancy: {{ oci_tenancy_id }} - user: {{ oci_user_id }} - key: | - {{ oci_private_key }} - - {% if oci_private_key_passphrase is defined %} - passphrase: {{ oci_private_key_passphrase }} - {% endif %} - - - fingerprint: {{ oci_user_fingerprint }} -{% endif %} - -# compartment configures Compartment within which the cluster resides. -compartment: {{ oci_compartment_id }} - -# vcn configures the Virtual Cloud Network (VCN) within which the cluster resides. -vcn: {{ oci_vnc_id }} - -loadBalancer: - # subnet1 configures one of two subnets to which load balancers will be added. - # OCI load balancers require two subnets to ensure high availability. - subnet1: {{ oci_subnet1_id }} -{% if oci_subnet2_id is defined %} - # subnet2 configures the second of two subnets to which load balancers will be - # added. OCI load balancers require two subnets to ensure high availability. - subnet2: {{ oci_subnet2_id }} -{% endif %} - # SecurityListManagementMode configures how security lists are managed by the CCM. - # "All" (default): Manage all required security list rules for load balancer services. - # "Frontend": Manage only security list rules for ingress to the load - # balancer. Requires that the user has setup a rule that - # allows inbound traffic to the appropriate ports for kube - # proxy health port, node port ranges, and health check port ranges. - # E.g. 10.82.0.0/16 30000-32000. - # "None": Disables all security list management. Requires that the - # user has setup a rule that allows inbound traffic to the - # appropriate ports for kube proxy health port, node port - # ranges, and health check port ranges. E.g. 10.82.0.0/16 30000-32000. - # Additionally requires the user to mange rules to allow - # inbound traffic to load balancers. - securityListManagementMode: {{ oci_security_list_management }} - -{% if oci_security_lists is defined and oci_security_lists | length > 0 %} - # Optional specification of which security lists to modify per subnet. This does not apply if security list management is off. - securityLists: -{% for subnet_ocid, list_ocid in oci_security_lists.items() %} - {{ subnet_ocid }}: {{ list_ocid }} -{% endfor %} -{% endif %} - -{% if oci_rate_limit is defined and oci_rate_limit | length > 0 %} -# Optional rate limit controls for accessing OCI API -rateLimiter: -{% if oci_rate_limit.rate_limit_qps_read %} - rateLimitQPSRead: {{ oci_rate_limit.rate_limit_qps_read }} -{% endif %} -{% if oci_rate_limit.rate_limit_qps_write %} - rateLimitQPSWrite: {{ oci_rate_limit.rate_limit_qps_write }} -{% endif %} -{% if oci_rate_limit.rate_limit_bucket_read %} - rateLimitBucketRead: {{ oci_rate_limit.rate_limit_bucket_read }} -{% endif %} -{% if oci_rate_limit.rate_limit_bucket_write %} - rateLimitBucketWrite: {{ oci_rate_limit.rate_limit_bucket_write }} -{% endif %} -{% endif %} diff --git a/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/main.yml index ef4737e..bbb53a3 100644 --- a/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/main.yml +++ b/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/main.yml @@ -59,13 +59,6 @@ - inventory_hostname == groups['kube_control_plane'][0] tags: node-webhook -- name: Configure Oracle Cloud provider - include_tasks: oci.yml - tags: oci - when: - - cloud_provider is defined - - cloud_provider == 'oci' - - name: PriorityClass | Copy k8s-cluster-critical-pc.yml file copy: src: k8s-cluster-critical-pc.yml diff --git a/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/oci.yml b/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/oci.yml deleted file mode 100644 index e5bef67..0000000 --- a/kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/oci.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -- name: Copy OCI RBAC Manifest - copy: - src: "oci-rbac.yml" - dest: "{{ kube_config_dir }}/oci-rbac.yml" - mode: "0640" - when: - - cloud_provider is defined - - cloud_provider == 'oci' - - inventory_hostname == groups['kube_control_plane'][0] - -- name: Apply OCI RBAC - kube: - kubectl: "{{ bin_dir }}/kubectl" - filename: "{{ kube_config_dir }}/oci-rbac.yml" - when: - - cloud_provider is defined - - cloud_provider == 'oci' - - inventory_hostname == groups['kube_control_plane'][0] diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/OWNERS b/kubespray/project/roles/kubernetes-apps/csi_driver/OWNERS deleted file mode 100644 index 6cfbaa8..0000000 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: -reviewers: - - alijahnas - - luckySB diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/cinder/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/csi_driver/cinder/tasks/main.yml index f2d1026..fe5ae0b 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/cinder/tasks/main.yml +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/cinder/tasks/main.yml @@ -9,7 +9,7 @@ loop_control: loop_var: delegate_host_to_write_cacert when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - cinder_cacert is defined - cinder_cacert | length > 0 diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-controller.yml.j2 b/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-controller.yml.j2 index 9ee2536..361b6a7 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-controller.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-controller.yml.j2 @@ -100,7 +100,7 @@ spec: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ imagePullSecrets: - - name: regcred + - name: upcloud volumes: - name: socket-dir emptyDir: {} diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-node.yml.j2 b/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-node.yml.j2 index 36fd75f..5727e1a 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-node.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-node.yml.j2 @@ -77,7 +77,7 @@ spec: - name: device-dir mountPath: /dev imagePullSecrets: - - name: regcred + - name: upcloud volumes: - name: registration-dir hostPath: diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml index 325e3cb..684f6c4 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml @@ -4,14 +4,14 @@ external_vsphere_insecure: "true" external_vsphere_kubernetes_cluster_id: "kubernetes-cluster-id" external_vsphere_version: "7.0u1" -vsphere_syncer_image_tag: "v3.1.0" +vsphere_syncer_image_tag: "v3.3.1" vsphere_csi_attacher_image_tag: "v4.3.0" -vsphere_csi_controller: "v3.1.0" +vsphere_csi_controller: "v3.3.1" vsphere_csi_liveness_probe_image_tag: "v2.10.0" vsphere_csi_provisioner_image_tag: "v3.5.0" vsphere_csi_snapshotter_image_tag: "v6.2.2" vsphere_csi_node_driver_registrar_image_tag: "v2.8.0" -vsphere_csi_driver_image_tag: "v3.1.0" +vsphere_csi_driver_image_tag: "v3.3.1" vsphere_csi_resizer_tag: "v1.8.0" # Set to kube-system for backward compatibility, should be change to vmware-system-csi on the long run diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-config.yml.j2 b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-config.yml.j2 index 2748896..caad7a3 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-config.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-config.yml.j2 @@ -19,12 +19,10 @@ data: "multi-vcenter-csi-topology": "true" "csi-internal-generated-cluster-id": "true" "listview-tasks": "true" -{% if vsphere_csi_controller is version('v2.7.0', '>=') %} "improved-csi-idempotency": "true" "improved-volume-topology": "true" "use-csinode-id": "true" "list-volumes": "false" -{% endif %} kind: ConfigMap metadata: name: internal-feature-states.csi.vsphere.vmware.com diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-deployment.yml.j2 b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-deployment.yml.j2 index 00d6e6a..6a1f319 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-deployment.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-deployment.yml.j2 @@ -99,7 +99,7 @@ spec: name: socket-dir {% endif %} - name: vsphere-csi-controller - image: {{ gcr_image_repo }}/cloud-provider-vsphere/csi/release/driver:{{ vsphere_csi_controller }} + image: {{ kube_image_repo }}/csi-vsphere/driver:{{ vsphere_csi_controller }} args: - "--fss-name=internal-feature-states.csi.vsphere.vmware.com" - "--fss-namespace={{ vsphere_csi_namespace }}" @@ -168,7 +168,7 @@ spec: - name: socket-dir mountPath: {{ csi_endpoint }} - name: vsphere-syncer - image: {{ gcr_image_repo }}/cloud-provider-vsphere/csi/release/syncer:{{ vsphere_syncer_image_tag }} + image: {{ kube_image_repo }}/csi-vsphere/syncer:{{ vsphere_syncer_image_tag }} args: - "--leader-election" - "--leader-election-lease-duration=30s" diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-rbac.yml.j2 b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-rbac.yml.j2 index 013d3dc..447d57d 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-rbac.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-rbac.yml.j2 @@ -33,11 +33,9 @@ rules: - apiGroups: [""] resources: ["events"] verbs: ["get", "list", "watch", "create", "update", "patch"] -{% if vsphere_csi_controller is version('v2.0.0', '>=') %} - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["get", "watch", "list", "delete", "update", "create"] -{% endif %} - apiGroups: ["storage.k8s.io"] resources: ["storageclasses","csinodes"] verbs: ["get", "list", "watch"] diff --git a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-node.yml.j2 b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-node.yml.j2 index e110ee3..ebf85a4 100644 --- a/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-node.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-node.yml.j2 @@ -62,7 +62,7 @@ spec: - --mode=kubelet-registration-probe initialDelaySeconds: 3 - name: vsphere-csi-node - image: {{ gcr_image_repo }}/cloud-provider-vsphere/csi/release/driver:{{ vsphere_csi_driver_image_tag }} + image: {{ kube_image_repo }}/csi-vsphere/driver:{{ vsphere_csi_driver_image_tag }} imagePullPolicy: {{ k8s_image_pull_policy }} args: - "--fss-name=internal-feature-states.csi.vsphere.vmware.com" diff --git a/kubespray/project/roles/kubernetes-apps/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/defaults/main.yml new file mode 100644 index 0000000..b794a98 --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/defaults/main.yml @@ -0,0 +1,2 @@ +--- +namespace: kube-system diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/huaweicloud/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/huaweicloud/defaults/main.yml index 9cd42ed..ac052d5 100644 --- a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/huaweicloud/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/huaweicloud/defaults/main.yml @@ -2,12 +2,12 @@ # The external cloud controller will need credentials to access # openstack apis. Per default these values will be # read from the environment. -external_huaweicloud_auth_url: "{{ lookup('env','OS_AUTH_URL') }}" -external_huaweicloud_access_key: "{{ lookup('env','OS_ACCESS_KEY') }}" -external_huaweicloud_secret_key: "{{ lookup('env','OS_SECRET_KEY') }}" -external_huaweicloud_region: "{{ lookup('env','OS_REGION_NAME') }}" -external_huaweicloud_project_id: "{{ lookup('env','OS_TENANT_ID')| default(lookup('env','OS_PROJECT_ID'),true) }}" -external_huaweicloud_cloud: "{{ lookup('env','OS_CLOUD') }}" +external_huaweicloud_auth_url: "{{ lookup('env', 'OS_AUTH_URL') }}" +external_huaweicloud_access_key: "{{ lookup('env', 'OS_ACCESS_KEY') }}" +external_huaweicloud_secret_key: "{{ lookup('env', 'OS_SECRET_KEY') }}" +external_huaweicloud_region: "{{ lookup('env', 'OS_REGION_NAME') }}" +external_huaweicloud_project_id: "{{ lookup('env', 'OS_TENANT_ID') | default(lookup('env', 'OS_PROJECT_ID'), true) }}" +external_huaweicloud_cloud: "{{ lookup('env', 'OS_CLOUD') }}" ## A dictionary of extra arguments to add to the huawei cloud controller manager deployment ## Format: diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/meta/main.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/meta/main.yml index b1fc4ad..fffd57a 100644 --- a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/meta/main.yml +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/meta/main.yml @@ -2,9 +2,7 @@ dependencies: - role: kubernetes-apps/external_cloud_controller/openstack when: - - cloud_provider is defined - cloud_provider == "external" - - external_cloud_provider is defined - external_cloud_provider == "openstack" - inventory_hostname == groups['kube_control_plane'][0] tags: @@ -12,9 +10,7 @@ dependencies: - external-openstack - role: kubernetes-apps/external_cloud_controller/vsphere when: - - cloud_provider is defined - cloud_provider == "external" - - external_cloud_provider is defined - external_cloud_provider == "vsphere" - inventory_hostname == groups['kube_control_plane'][0] tags: @@ -22,9 +18,7 @@ dependencies: - external-vsphere - role: kubernetes-apps/external_cloud_controller/hcloud when: - - cloud_provider is defined - cloud_provider == "external" - - external_cloud_provider is defined - external_cloud_provider == "hcloud" - inventory_hostname == groups['kube_control_plane'][0] tags: @@ -32,11 +26,17 @@ dependencies: - external-hcloud - role: kubernetes-apps/external_cloud_controller/huaweicloud when: - - cloud_provider is defined - cloud_provider == "external" - - external_cloud_provider is defined - external_cloud_provider == "huaweicloud" - inventory_hostname == groups['kube_control_plane'][0] tags: - external-cloud-controller - external-huaweicloud + - role: kubernetes-apps/external_cloud_controller/oci + when: + - cloud_provider == "external" + - external_cloud_provider == "oci" + - inventory_hostname == groups['kube_control_plane'][0] + tags: + - external-cloud-controller + - external-oci diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/defaults/main.yml new file mode 100644 index 0000000..a383273 --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/defaults/main.yml @@ -0,0 +1,25 @@ +--- +## External Oracle Cloud Controller Manager +## https://github.com/oracle/oci-cloud-controller-manager/blob/v1.29.0/manifests/provider-config-example.yaml +external_oracle_auth_region: "" +external_oracle_auth_tenancy: "" +external_oracle_auth_user: "" +external_oracle_auth_key: "" +external_oracle_auth_passphrase: "" +external_oracle_auth_fingerprint: "" +external_oracle_auth_use_instance_principals: false + +external_oracle_compartment: "" +external_oracle_vcn: "" +external_oracle_load_balancer_subnet1: "" +external_oracle_load_balancer_subnet2: "" +external_oracle_load_balancer_security_list_management_mode: All +external_oracle_load_balancer_security_lists: {} + +external_oracle_ratelimiter_qps_read: 20.0 +external_oracle_ratelimiter_bucket_read: 5 +external_oracle_ratelimiter_qps_write: 20.0 +external_oracle_ratelimiter_bucket_write: 5 + +external_oracle_cloud_controller_image_repo: ghcr.io/oracle/cloud-provider-oci +external_oracle_cloud_controller_image_tag: "v1.29.0" diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml new file mode 100644 index 0000000..da80e9d --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml @@ -0,0 +1,53 @@ +--- +- name: "External OCI Cloud Controller Manager | Check credentials" + ansible.builtin.assert: + that: + - external_oracle_auth_key | length > 0 + - external_oracle_auth_region | length > 0 + - external_oracle_auth_tenancy | length > 0 + - external_oracle_auth_user | length > 0 + - external_oracle_auth_fingerprint | length > 0 + when: not external_oracle_auth_use_instance_principals + +- name: "External OCI Cloud Controller Manager | Check settings" + ansible.builtin.assert: + that: + - external_oracle_compartment | length > 0 + - external_oracle_vcn | length > 0 + - external_oracle_load_balancer_subnet1 | length > 0 + - external_oracle_load_balancer_subnet2 | length > 0 + - external_oracle_load_balancer_security_list_management_mode in ["All", "Frontend", "None"] + +- name: External OCI Cloud Controller Manager | Get base64 cloud-config + set_fact: + external_oracle_cloud_config_secret: "{{ lookup('template', 'external-oci-cloud-config.j2') | b64encode }}" + when: inventory_hostname == groups['kube_control_plane'][0] + tags: external-oci + +- name: External OCI Cloud Controller Manager | Generate Manifests + template: + src: "{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.file }}" + group: "{{ kube_cert_group }}" + mode: "0640" + with_items: + - {name: external-oci-cloud-config-secret, file: external-oci-cloud-config-secret.yml} + - {name: external-oci-cloud-controller-manager-rbac, file: external-oci-cloud-controller-manager-rbac.yml} + - {name: external-oci-cloud-controller-manager, file: external-oci-cloud-controller-manager.yml} + register: external_oracle_manifests + when: inventory_hostname == groups['kube_control_plane'][0] + tags: external-oci + +- name: External OCI Cloud Controller Manager | Apply Manifests + kube: + kubectl: "{{ bin_dir }}/kubectl" + filename: "{{ kube_config_dir }}/{{ item.item.file }}" + state: "latest" + with_items: + - "{{ external_oracle_manifests.results }}" + when: + - inventory_hostname == groups['kube_control_plane'][0] + - not item is skipped + loop_control: + label: "{{ item.item.file }}" + tags: external-oci diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config-secret.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config-secret.yml.j2 new file mode 100644 index 0000000..baa20b6 --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config-secret.yml.j2 @@ -0,0 +1,10 @@ +# This YAML file contains secret objects, +# which are necessary to run external oci cloud controller. + +kind: Secret +apiVersion: v1 +metadata: + name: oci-cloud-controller-manager + namespace: kube-system +data: + cloud-provider.yaml: {{ external_oracle_cloud_config_secret }} diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config.yml.j2 new file mode 100644 index 0000000..5af04b2 --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config.yml.j2 @@ -0,0 +1,45 @@ +{% if external_oracle_auth_use_instance_principals %} +useInstancePrincipals: true +{% endif %} + +auth: +{% if external_oracle_auth_use_instance_principals %} + useInstancePrincipals: true +{% else %} + useInstancePrincipals: false + region: {{ external_oracle_auth_region }} + tenancy: {{ external_oracle_auth_tenancy }} + user: {{ external_oracle_auth_user }} + key: | + {{ external_oracle_auth_key }} + {% if external_oracle_auth_passphrase is defined %} + # Omit if there is not a password for the key + passphrase: {{ external_oracle_auth_passphrase }} + {% endif %} + fingerprint: {{ external_oracle_auth_fingerprint }} +{% endif %} + +compartment: {{ external_oracle_compartment }} + +vcn: {{ external_oracle_vcn }} + +loadBalancer: + subnet1: {{ external_oracle_load_balancer_subnet1 }} + subnet2: {{ external_oracle_load_balancer_subnet2 }} + + securityListManagementMode: {{ external_oracle_load_balancer_security_list_management_mode }} + +{% if external_oracle_security_lists is defined and external_oracle_security_lists | length > 0 %} + # Optional specification of which security lists to modify per subnet. This does not apply if security list management is off. + securityLists: + {% for subnet_ocid, list_ocid in external_oracle_load_balancer_security_lists.items() %} + {{ subnet_ocid }}: {{ list_ocid }} + {% endfor %} +{% endif %} + +# Optional rate limit controls for accessing OCI API +rateLimiter: + rateLimitQPSRead: {{ external_oracle_ratelimiter_qps_read }} + rateLimitBucketRead: {{ external_oracle_ratelimiter_bucket_read }} + rateLimitQPSWrite: {{ external_oracle_ratelimiter_qps_write }} + rateLimitBucketWrite: {{ external_oracle_ratelimiter_bucket_write }} diff --git a/kubespray/project/roles/kubernetes-apps/cluster_roles/files/oci-rbac.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager-rbac.yml.j2 similarity index 74% rename from kubespray/project/roles/kubernetes-apps/cluster_roles/files/oci-rbac.yml rename to kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager-rbac.yml.j2 index 5e3b82b..e7ab8ca 100644 --- a/kubespray/project/roles/kubernetes-apps/cluster_roles/files/oci-rbac.yml +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager-rbac.yml.j2 @@ -9,6 +9,8 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: system:cloud-controller-manager + labels: + kubernetes.io/cluster-service: "true" rules: - apiGroups: - "" @@ -32,19 +34,33 @@ rules: - list - watch - patch + - get - apiGroups: - "" resources: - services/status verbs: + - patch + - get - update +- apiGroups: + - "" + resources: + - configmaps + resourceNames: + - "extension-apiserver-authentication" + verbs: + - get + - apiGroups: - "" resources: - events verbs: + - list + - watch - create - patch - update @@ -76,6 +92,18 @@ rules: verbs: - create +- apiGroups: + - "coordination.k8s.io" + resources: + - leases + verbs: + - get + - create + - update + - delete + - patch + - watch + - apiGroups: - "" resources: @@ -86,12 +114,26 @@ rules: - get - update +- apiGroups: + - "" + resources: + - configmaps + resourceNames: + - "extension-apiserver-authentication" + verbs: + - get + - list + - watch + - apiGroups: - "" resources: - serviceaccounts verbs: - create + - list + - get + - watch - apiGroups: - "" resources: diff --git a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/oci-cloud-provider.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager.yml.j2 similarity index 73% rename from kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/oci-cloud-provider.yml.j2 rename to kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager.yml.j2 index e1fc11d..8d14ca4 100644 --- a/kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/oci-cloud-provider.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager.yml.j2 @@ -1,12 +1,3 @@ -apiVersion: v1 -data: - cloud-provider.yaml: {{ controller_manager_config_base64 }} -kind: Secret -metadata: - name: oci-cloud-controller-manager - namespace: kube-system -type: Opaque - --- apiVersion: apps/v1 kind: DaemonSet @@ -28,13 +19,8 @@ spec: component: oci-cloud-controller-manager tier: control-plane spec: -{% if oci_cloud_controller_pull_secret is defined %} - imagePullSecrets: - - name: {{ oci_cloud_controller_pull_secret }} -{% endif %} serviceAccountName: cloud-controller-manager hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet nodeSelector: node-role.kubernetes.io/control-plane: "" tolerations: @@ -44,6 +30,9 @@ spec: - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule volumes: - name: cfg secret: @@ -53,13 +42,14 @@ spec: path: /etc/kubernetes containers: - name: oci-cloud-controller-manager - image: {{ oci_cloud_controller_pull_source }}:{{ oci_cloud_controller_version }} + image: {{ external_oracle_cloud_controller_image_repo }}:{{ external_oracle_cloud_controller_image_tag }} command: ["/usr/local/bin/oci-cloud-controller-manager"] args: - --cloud-config=/etc/oci/cloud-provider.yaml - --cloud-provider=oci - - --leader-elect-resource-lock=configmaps - - -v=2 + - --leader-elect-resource-lock=leases + - --concurrent-service-syncs=3 + - --v=2 volumeMounts: - name: cfg mountPath: /etc/oci diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/OWNERS b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/OWNERS deleted file mode 100644 index 6cfbaa8..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: -reviewers: - - alijahnas - - luckySB diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/defaults/main.yml index ab5f152..6b57fc3 100644 --- a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/defaults/main.yml @@ -21,6 +21,6 @@ external_openstack_cacert: "{{ lookup('env', 'OS_CACERT') }}" ## arg1: "value1" ## arg2: "value2" external_openstack_cloud_controller_extra_args: {} -external_openstack_cloud_controller_image_tag: "v1.30.0" +external_openstack_cloud_controller_image_tag: "v1.32.0" external_openstack_cloud_controller_bind_address: 127.0.0.1 external_openstack_cloud_controller_dns_policy: ClusterFirst diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/defaults/main.yml index b6fb797..3bbc328 100644 --- a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/defaults/main.yml @@ -8,7 +8,7 @@ external_vsphere_insecure: "true" ## arg1: "value1" ## arg2: "value2" external_vsphere_cloud_controller_extra_args: {} -external_vsphere_cloud_controller_image_tag: "latest" +external_vsphere_cloud_controller_image_tag: "v1.31.0" external_vsphere_user: "{{ lookup('env', 'VSPHERE_USER') }}" external_vsphere_password: "{{ lookup('env', 'VSPHERE_PASSWORD') }}" diff --git a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/templates/external-vsphere-cloud-controller-manager-ds.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/templates/external-vsphere-cloud-controller-manager-ds.yml.j2 index 05e4ac3..9434099 100644 --- a/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/templates/external-vsphere-cloud-controller-manager-ds.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/templates/external-vsphere-cloud-controller-manager-ds.yml.j2 @@ -36,7 +36,7 @@ spec: serviceAccountName: cloud-controller-manager containers: - name: vsphere-cloud-controller-manager - image: {{ gcr_image_repo }}/cloud-provider-vsphere/cpi/release/manager:{{ external_vsphere_cloud_controller_image_tag }} + image: {{ kube_image_repo }}/cloud-pv-vsphere/cloud-provider-vsphere:{{ external_vsphere_cloud_controller_image_tag }} args: - --v=2 - --cloud-provider=vsphere diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/defaults/main.yml deleted file mode 100644 index 577fbff..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/defaults/main.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -cephfs_provisioner_namespace: "cephfs-provisioner" -cephfs_provisioner_cluster: ceph -cephfs_provisioner_monitors: ~ -cephfs_provisioner_admin_id: admin -cephfs_provisioner_secret: secret -cephfs_provisioner_storage_class: cephfs -cephfs_provisioner_reclaim_policy: Delete -cephfs_provisioner_claim_root: /volumes -cephfs_provisioner_deterministic_names: true diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/tasks/main.yml deleted file mode 100644 index 4993eeb..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/tasks/main.yml +++ /dev/null @@ -1,71 +0,0 @@ ---- - -- name: CephFS Provisioner | Remove legacy addon dir and manifests - file: - path: "{{ kube_config_dir }}/addons/cephfs_provisioner" - state: absent - when: - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - upgrade - -- name: CephFS Provisioner | Remove legacy namespace - command: > - {{ kubectl }} delete namespace {{ cephfs_provisioner_namespace }} - ignore_errors: true # noqa ignore-errors - when: - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - upgrade - -- name: CephFS Provisioner | Remove legacy storageclass - command: > - {{ kubectl }} delete storageclass {{ cephfs_provisioner_storage_class }} - ignore_errors: true # noqa ignore-errors - when: - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - upgrade - -- name: CephFS Provisioner | Create addon dir - file: - path: "{{ kube_config_dir }}/addons/cephfs_provisioner" - state: directory - owner: root - group: root - mode: "0755" - when: - - inventory_hostname == groups['kube_control_plane'][0] - -- name: CephFS Provisioner | Templates list - set_fact: - cephfs_provisioner_templates: - - { name: 00-namespace, file: 00-namespace.yml, type: ns } - - { name: secret-cephfs-provisioner, file: secret-cephfs-provisioner.yml, type: secret } - - { name: sa-cephfs-provisioner, file: sa-cephfs-provisioner.yml, type: sa } - - { name: clusterrole-cephfs-provisioner, file: clusterrole-cephfs-provisioner.yml, type: clusterrole } - - { name: clusterrolebinding-cephfs-provisioner, file: clusterrolebinding-cephfs-provisioner.yml, type: clusterrolebinding } - - { name: role-cephfs-provisioner, file: role-cephfs-provisioner.yml, type: role } - - { name: rolebinding-cephfs-provisioner, file: rolebinding-cephfs-provisioner.yml, type: rolebinding } - - { name: deploy-cephfs-provisioner, file: deploy-cephfs-provisioner.yml, type: deploy } - - { name: sc-cephfs-provisioner, file: sc-cephfs-provisioner.yml, type: sc } - -- name: CephFS Provisioner | Create manifests - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/addons/cephfs_provisioner/{{ item.file }}" - mode: "0644" - with_items: "{{ cephfs_provisioner_templates }}" - register: cephfs_provisioner_manifests - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: CephFS Provisioner | Apply manifests - kube: - name: "{{ item.item.name }}" - namespace: "{{ cephfs_provisioner_namespace }}" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/addons/cephfs_provisioner/{{ item.item.file }}" - state: "latest" - with_items: "{{ cephfs_provisioner_manifests.results }}" - when: inventory_hostname == groups['kube_control_plane'][0] diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/00-namespace.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/00-namespace.yml.j2 deleted file mode 100644 index 2a2a67c..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/00-namespace.yml.j2 +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ cephfs_provisioner_namespace }} - labels: - name: {{ cephfs_provisioner_namespace }} diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrole-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrole-cephfs-provisioner.yml.j2 deleted file mode 100644 index c6a1490..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrole-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "create", "delete"] diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrolebinding-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrolebinding-cephfs-provisioner.yml.j2 deleted file mode 100644 index cc5d5ff..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrolebinding-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cephfs-provisioner -subjects: - - kind: ServiceAccount - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} -roleRef: - kind: ClusterRole - name: cephfs-provisioner - apiGroup: rbac.authorization.k8s.io diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/deploy-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/deploy-cephfs-provisioner.yml.j2 deleted file mode 100644 index 8d9eb08..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/deploy-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,34 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} - labels: - app: cephfs-provisioner - version: {{ cephfs_provisioner_image_tag }} -spec: - replicas: 1 - selector: - matchLabels: - app: cephfs-provisioner - version: {{ cephfs_provisioner_image_tag }} - template: - metadata: - labels: - app: cephfs-provisioner - version: {{ cephfs_provisioner_image_tag }} - spec: - priorityClassName: {% if cephfs_provisioner_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{ '' }} - serviceAccount: cephfs-provisioner - containers: - - name: cephfs-provisioner - image: {{ cephfs_provisioner_image_repo }}:{{ cephfs_provisioner_image_tag }} - imagePullPolicy: {{ k8s_image_pull_policy }} - env: - - name: PROVISIONER_NAME - value: ceph.com/cephfs - command: - - "/usr/local/bin/cephfs-provisioner" - args: - - "-id=cephfs-provisioner-1" diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/role-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/role-cephfs-provisioner.yml.j2 deleted file mode 100644 index 1fb80a1..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/role-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["create", "get", "delete"] - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/rolebinding-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/rolebinding-cephfs-provisioner.yml.j2 deleted file mode 100644 index 01ab87b..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/rolebinding-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} -subjects: - - kind: ServiceAccount - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cephfs-provisioner diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sa-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sa-cephfs-provisioner.yml.j2 deleted file mode 100644 index 31f87bd..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sa-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sc-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sc-cephfs-provisioner.yml.j2 deleted file mode 100644 index dd0e37e..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sc-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ cephfs_provisioner_storage_class }} -provisioner: ceph.com/cephfs -reclaimPolicy: {{ cephfs_provisioner_reclaim_policy }} -parameters: - cluster: {{ cephfs_provisioner_cluster }} - monitors: {{ cephfs_provisioner_monitors }} - adminId: {{ cephfs_provisioner_admin_id }} - adminSecretName: cephfs-provisioner - adminSecretNamespace: {{ cephfs_provisioner_namespace }} - claimRoot: {{ cephfs_provisioner_claim_root }} - deterministicNames: "{{ cephfs_provisioner_deterministic_names | bool | lower }}" diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/secret-cephfs-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/secret-cephfs-provisioner.yml.j2 deleted file mode 100644 index 6d73c0c..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/secret-cephfs-provisioner.yml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -kind: Secret -apiVersion: v1 -metadata: - name: cephfs-provisioner - namespace: {{ cephfs_provisioner_namespace }} -type: Opaque -data: - secret: {{ cephfs_provisioner_secret | b64encode }} diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/meta/main.yml b/kubespray/project/roles/kubernetes-apps/external_provisioner/meta/main.yml index 13bc8b6..3269f82 100644 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/meta/main.yml +++ b/kubespray/project/roles/kubernetes-apps/external_provisioner/meta/main.yml @@ -9,19 +9,6 @@ dependencies: - local-volume-provisioner - external-provisioner - - role: kubernetes-apps/external_provisioner/cephfs_provisioner - when: cephfs_provisioner_enabled - tags: - - apps - - cephfs-provisioner - - external-provisioner - - - role: kubernetes-apps/external_provisioner/rbd_provisioner - when: rbd_provisioner_enabled - tags: - - apps - - rbd-provisioner - - external-provisioner - role: kubernetes-apps/external_provisioner/local_path_provisioner when: local_path_provisioner_enabled tags: diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/defaults/main.yml deleted file mode 100644 index f09e25a..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/defaults/main.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- -rbd_provisioner_namespace: "rbd-provisioner" -rbd_provisioner_replicas: 2 -rbd_provisioner_monitors: ~ -rbd_provisioner_pool: kube -rbd_provisioner_admin_id: admin -rbd_provisioner_secret_name: ceph-secret-admin -rbd_provisioner_secret: ceph-key-admin -rbd_provisioner_user_id: kube -rbd_provisioner_user_secret_name: ceph-secret-user -rbd_provisioner_user_secret: ceph-key-user -rbd_provisioner_user_secret_namespace: rbd-provisioner -rbd_provisioner_fs_type: ext4 -rbd_provisioner_image_format: "2" -rbd_provisioner_image_features: layering -rbd_provisioner_storage_class: rbd -rbd_provisioner_reclaim_policy: Delete diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/tasks/main.yml deleted file mode 100644 index 0a1f5b2..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/tasks/main.yml +++ /dev/null @@ -1,71 +0,0 @@ ---- - -- name: RBD Provisioner | Remove legacy addon dir and manifests - file: - path: "{{ kube_config_dir }}/addons/rbd_provisioner" - state: absent - when: - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - upgrade - -- name: RBD Provisioner | Remove legacy namespace - command: > - {{ kubectl }} delete namespace {{ rbd_provisioner_namespace }} - ignore_errors: true # noqa ignore-errors - when: - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - upgrade - -- name: RBD Provisioner | Remove legacy storageclass - command: > - {{ kubectl }} delete storageclass {{ rbd_provisioner_storage_class }} - ignore_errors: true # noqa ignore-errors - when: - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - upgrade - -- name: RBD Provisioner | Create addon dir - file: - path: "{{ kube_config_dir }}/addons/rbd_provisioner" - state: directory - owner: root - group: root - mode: "0755" - when: - - inventory_hostname == groups['kube_control_plane'][0] - -- name: RBD Provisioner | Templates list - set_fact: - rbd_provisioner_templates: - - { name: 00-namespace, file: 00-namespace.yml, type: ns } - - { name: secret-rbd-provisioner, file: secret-rbd-provisioner.yml, type: secret } - - { name: sa-rbd-provisioner, file: sa-rbd-provisioner.yml, type: sa } - - { name: clusterrole-rbd-provisioner, file: clusterrole-rbd-provisioner.yml, type: clusterrole } - - { name: clusterrolebinding-rbd-provisioner, file: clusterrolebinding-rbd-provisioner.yml, type: clusterrolebinding } - - { name: role-rbd-provisioner, file: role-rbd-provisioner.yml, type: role } - - { name: rolebinding-rbd-provisioner, file: rolebinding-rbd-provisioner.yml, type: rolebinding } - - { name: deploy-rbd-provisioner, file: deploy-rbd-provisioner.yml, type: deploy } - - { name: sc-rbd-provisioner, file: sc-rbd-provisioner.yml, type: sc } - -- name: RBD Provisioner | Create manifests - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/addons/rbd_provisioner/{{ item.file }}" - mode: "0644" - with_items: "{{ rbd_provisioner_templates }}" - register: rbd_provisioner_manifests - when: inventory_hostname == groups['kube_control_plane'][0] - -- name: RBD Provisioner | Apply manifests - kube: - name: "{{ item.item.name }}" - namespace: "{{ rbd_provisioner_namespace }}" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/addons/rbd_provisioner/{{ item.item.file }}" - state: "latest" - with_items: "{{ rbd_provisioner_manifests.results }}" - when: inventory_hostname == groups['kube_control_plane'][0] diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/00-namespace.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/00-namespace.yml.j2 deleted file mode 100644 index 8bec2b5..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/00-namespace.yml.j2 +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ rbd_provisioner_namespace }} - labels: - name: {{ rbd_provisioner_namespace }} diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrole-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrole-rbd-provisioner.yml.j2 deleted file mode 100644 index 9e319a3..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrole-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,26 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["services"] - resourceNames: ["kube-dns","coredns"] - verbs: ["list", "get"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "create", "delete"] diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrolebinding-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrolebinding-rbd-provisioner.yml.j2 deleted file mode 100644 index ae9e6c5..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrolebinding-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: rbd-provisioner -subjects: - - kind: ServiceAccount - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} -roleRef: - kind: ClusterRole - name: rbd-provisioner - apiGroup: rbac.authorization.k8s.io diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/deploy-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/deploy-rbd-provisioner.yml.j2 deleted file mode 100644 index b8643db..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/deploy-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,40 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} - labels: - app: rbd-provisioner - version: {{ rbd_provisioner_image_tag }} -spec: - replicas: {{ rbd_provisioner_replicas }} - strategy: - type: Recreate - selector: - matchLabels: - app: rbd-provisioner - version: {{ rbd_provisioner_image_tag }} - template: - metadata: - labels: - app: rbd-provisioner - version: {{ rbd_provisioner_image_tag }} - spec: - priorityClassName: {% if rbd_provisioner_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{ '' }} - serviceAccount: rbd-provisioner - containers: - - name: rbd-provisioner - image: {{ rbd_provisioner_image_repo }}:{{ rbd_provisioner_image_tag }} - imagePullPolicy: {{ k8s_image_pull_policy }} - env: - - name: PROVISIONER_NAME - value: ceph.com/rbd - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - command: - - "/usr/local/bin/rbd-provisioner" - args: - - "-id=${POD_NAME}" diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/role-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/role-rbd-provisioner.yml.j2 deleted file mode 100644 index d8dbbf9..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/role-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get"] - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/rolebinding-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/rolebinding-rbd-provisioner.yml.j2 deleted file mode 100644 index fcae1cc..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/rolebinding-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} -subjects: - - kind: ServiceAccount - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: rbd-provisioner diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sa-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sa-rbd-provisioner.yml.j2 deleted file mode 100644 index c4dce64..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sa-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: rbd-provisioner - namespace: {{ rbd_provisioner_namespace }} diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sc-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sc-rbd-provisioner.yml.j2 deleted file mode 100644 index 9fea17a..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sc-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,19 +0,0 @@ ---- -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ rbd_provisioner_storage_class }} -provisioner: ceph.com/rbd -reclaimPolicy: {{ rbd_provisioner_reclaim_policy }} -parameters: - monitors: {{ rbd_provisioner_monitors }} - adminId: {{ rbd_provisioner_admin_id }} - adminSecretNamespace: {{ rbd_provisioner_namespace }} - adminSecretName: {{ rbd_provisioner_secret_name }} - pool: {{ rbd_provisioner_pool }} - userId: {{ rbd_provisioner_user_id }} - userSecretNamespace: {{ rbd_provisioner_user_secret_namespace }} - userSecretName: {{ rbd_provisioner_user_secret_name }} - fsType: "{{ rbd_provisioner_fs_type }}" - imageFormat: "{{ rbd_provisioner_image_format }}" - imageFeatures: {{ rbd_provisioner_image_features }} diff --git a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/secret-rbd-provisioner.yml.j2 b/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/secret-rbd-provisioner.yml.j2 deleted file mode 100644 index a3b66d6..0000000 --- a/kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/secret-rbd-provisioner.yml.j2 +++ /dev/null @@ -1,18 +0,0 @@ ---- -kind: Secret -apiVersion: v1 -metadata: - name: {{ rbd_provisioner_secret_name }} - namespace: {{ rbd_provisioner_namespace }} -type: Opaque -data: - secret: {{ rbd_provisioner_secret | b64encode }} ---- -kind: Secret -apiVersion: v1 -metadata: - name: {{ rbd_provisioner_user_secret_name }} - namespace: {{ rbd_provisioner_user_secret_namespace }} -type: Opaque -data: - key: {{ rbd_provisioner_user_secret | b64encode }} diff --git a/kubespray/project/roles/kubernetes-apps/gateway_api/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/gateway_api/defaults/main.yml index 9896bbf..e861991 100644 --- a/kubespray/project/roles/kubernetes-apps/gateway_api/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/gateway_api/defaults/main.yml @@ -1,4 +1,9 @@ --- gateway_api_enabled: false -gateway_api_version: v1.1.0 -gateway_api_experimental_channel: false +gateway_api_version: 1.2.1 + +# `gateway_api_channel` default is "standard". +# "standard" release channel includes all resources that have graduated to GA or beta, including GatewayClass, Gateway, HTTPRoute, and ReferenceGrant. +# "experimental" for some experimental resources and fields. Note that future releases of the API could include breaking changes to experimental resources and fields. For example, any experimental resource or field could be removed in a future release. +# https://gateway-api.sigs.k8s.io/guides/#install-experimental-channel +gateway_api_channel: "standard" diff --git a/kubespray/project/roles/kubernetes-apps/gateway_api/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/gateway_api/tasks/main.yml index 107fa70..7134fe2 100644 --- a/kubespray/project/roles/kubernetes-apps/gateway_api/tasks/main.yml +++ b/kubespray/project/roles/kubernetes-apps/gateway_api/tasks/main.yml @@ -1,4 +1,9 @@ --- +- name: Gateway API | Download YAML + include_tasks: "../../../download/tasks/download_file.yml" + vars: + download: "{{ download_defaults | combine(downloads.gateway_api_crds) }}" + - name: Gateway API | Create addon dir file: path: "{{ kube_config_dir }}/addons/gateway_api" @@ -9,17 +14,12 @@ when: - inventory_hostname == groups['kube_control_plane'][0] -- name: Gateway API | Set channel - set_fact: - gateway_api_channel: "{{ 'experimental' if gateway_api_experimental_channel else 'standard' }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Gateway API | Copy Gateway API manifests to remote - template: - src: "{{ gateway_api_channel }}-install.yaml.j2" +- name: Gateway API | Copy YAML from download dir + copy: + src: "{{ local_release_dir }}/gateway-api-{{ gateway_api_channel }}-install.yaml" dest: "{{ kube_config_dir }}/addons/gateway_api/{{ gateway_api_channel }}-install.yaml" mode: "0644" + remote_src: true when: - "inventory_hostname == groups['kube_control_plane'][0]" diff --git a/kubespray/project/roles/kubernetes-apps/gateway_api/templates/experimental-install.yaml.j2 b/kubespray/project/roles/kubernetes-apps/gateway_api/templates/experimental-install.yaml.j2 deleted file mode 100644 index 8a50a1f..0000000 --- a/kubespray/project/roles/kubernetes-apps/gateway_api/templates/experimental-install.yaml.j2 +++ /dev/null @@ -1,18317 +0,0 @@ -# Copyright 2024 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# -# Gateway API Experimental channel install -# ---- -# -# config/crd/experimental/gateway.networking.k8s.io_backendlbpolicies.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: backendlbpolicies.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: BackendLBPolicy - listKind: BackendLBPolicyList - plural: backendlbpolicies - shortNames: - - blbpolicy - singular: backendlbpolicy - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - BackendLBPolicy provides a way to define load balancing rules - for a backend. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of BackendLBPolicy. - properties: - sessionPersistence: - description: |- - SessionPersistence defines and configures session persistence - for the backend. - - - Support: Extended - properties: - absoluteTimeout: - description: |- - AbsoluteTimeout defines the absolute timeout of the persistent - session. Once the AbsoluteTimeout duration has elapsed, the - session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - cookieConfig: - description: |- - CookieConfig provides configuration settings that are specific - to cookie-based session persistence. - - - Support: Core - properties: - lifetimeType: - default: Session - description: |- - LifetimeType specifies whether the cookie has a permanent or - session-based lifetime. A permanent cookie persists until its - specified expiry time, defined by the Expires or Max-Age cookie - attributes, while a session cookie is deleted when the current - session ends. - - - When set to "Permanent", AbsoluteTimeout indicates the - cookie's lifetime via the Expires or Max-Age cookie attributes - and is required. - - - When set to "Session", AbsoluteTimeout indicates the - absolute lifetime of the cookie tracked by the gateway and - is optional. - - - Support: Core for "Session" type - - - Support: Extended for "Permanent" type - enum: - - Permanent - - Session - type: string - type: object - idleTimeout: - description: |- - IdleTimeout defines the idle timeout of the persistent session. - Once the session has been idle for more than the specified - IdleTimeout duration, the session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - sessionName: - description: |- - SessionName defines the name of the persistent session token - which may be reflected in the cookie or the header. Users - should avoid reusing session names to prevent unintended - consequences, such as rejection or unpredictable behavior. - - - Support: Implementation-specific - maxLength: 128 - type: string - type: - default: Cookie - description: |- - Type defines the type of session persistence such as through - the use a header or cookie. Defaults to cookie based session - persistence. - - - Support: Core for "Cookie" type - - - Support: Extended for "Header" type - enum: - - Cookie - - Header - type: string - type: object - x-kubernetes-validations: - - message: AbsoluteTimeout must be specified when cookie lifetimeType - is Permanent - rule: '!has(self.cookieConfig.lifetimeType) || self.cookieConfig.lifetimeType - != ''Permanent'' || has(self.absoluteTimeout)' - targetRefs: - description: |- - TargetRef identifies an API object to apply policy to. - Currently, Backends (i.e. Service, ServiceImport, or any - implementation-specific backendRef) are the only valid API - target references. - items: - description: |- - LocalPolicyTargetReference identifies an API object to apply a direct or - inherited policy to. This should be used as part of Policy resources - that can target Gateway API resources. For more information on how this - policy attachment model works, and a sample Policy resource, refer to - the policy attachment documentation for Gateway API. - properties: - group: - description: Group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - maxItems: 16 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - group - - kind - - name - x-kubernetes-list-type: map - required: - - targetRefs - type: object - status: - description: Status defines the current state of BackendLBPolicy. - properties: - ancestors: - description: |- - Ancestors is a list of ancestor resources (usually Gateways) that are - associated with the policy, and the status of the policy with respect to - each ancestor. When this policy attaches to a parent, the controller that - manages the parent and the ancestors MUST add an entry to this list when - the controller first sees the policy and SHOULD update the entry as - appropriate when the relevant ancestor is modified. - - - Note that choosing the relevant ancestor is left to the Policy designers; - an important part of Policy design is designing the right object level at - which to namespace this status. - - - Note also that implementations MUST ONLY populate ancestor status for - the Ancestor resources they are responsible for. Implementations MUST - use the ControllerName field to uniquely identify the entries in this list - that they are responsible for. - - - Note that to achieve this, the list of PolicyAncestorStatus structs - MUST be treated as a map with a composite key, made up of the AncestorRef - and ControllerName fields combined. - - - A maximum of 16 ancestors will be represented in this list. An empty list - means the Policy is not relevant for any ancestors. - - - If this slice is full, implementations MUST NOT add further entries. - Instead they MUST consider the policy unimplementable and signal that - on any related resources such as the ancestor that would be referenced - here. For example, if this list was full on BackendTLSPolicy, no - additional Gateways would be able to reference the Service targeted by - the BackendTLSPolicy. - items: - description: |- - PolicyAncestorStatus describes the status of a route with respect to an - associated Ancestor. - - - Ancestors refer to objects that are either the Target of a policy or above it - in terms of object hierarchy. For example, if a policy targets a Service, the - Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and - the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most - useful object to place Policy status on, so we recommend that implementations - SHOULD use Gateway as the PolicyAncestorStatus object unless the designers - have a _very_ good reason otherwise. - - - In the context of policy attachment, the Ancestor is used to distinguish which - resource results in a distinct application of this policy. For example, if a policy - targets a Service, it may have a distinct result per attached Gateway. - - - Policies targeting the same resource may have different effects depending on the - ancestors of those resources. For example, different Gateways targeting the same - Service may have different capabilities, especially if they have different underlying - implementations. - - - For example, in BackendTLSPolicy, the Policy attaches to a Service that is - used as a backend in a HTTPRoute that is itself attached to a Gateway. - In this case, the relevant object for status is the Gateway, and that is the - ancestor object referred to in this status. - - - Note that a parent is also an ancestor, so for objects where the parent is the - relevant object for status, this struct SHOULD still be used. - - - This struct is intended to be used in a slice that's effectively a map, - with a composite key made up of the AncestorRef and the ControllerName. - properties: - ancestorRef: - description: |- - AncestorRef corresponds with a ParentRef in the spec that this - PolicyAncestorStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - conditions: - description: Conditions describes the status of the Policy with - respect to the given Ancestor. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - required: - - ancestorRef - - controllerName - type: object - maxItems: 16 - type: array - required: - - ancestors - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - labels: - gateway.networking.k8s.io/policy: Direct - name: backendtlspolicies.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: BackendTLSPolicy - listKind: BackendTLSPolicyList - plural: backendtlspolicies - shortNames: - - btlspolicy - singular: backendtlspolicy - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - description: |- - BackendTLSPolicy provides a way to configure how a Gateway - connects to a Backend via TLS. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of BackendTLSPolicy. - properties: - targetRefs: - description: |- - TargetRefs identifies an API object to apply the policy to. - Only Services have Extended support. Implementations MAY support - additional objects, with Implementation Specific support. - Note that this config applies to the entire referenced resource - by default, but this default may change in the future to provide - a more granular application of the policy. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - items: - description: |- - LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a - direct policy to. This should be used as part of Policy resources that can - target single resources. For more information on how this policy attachment - mode works, and a sample Policy resource, refer to the policy attachment - documentation for Gateway API. - - - Note: This should only be used for direct policy attachment when references - to SectionName are actually needed. In all other cases, - LocalPolicyTargetReference should be used. - properties: - group: - description: Group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - sectionName: - description: |- - SectionName is the name of a section within the target resource. When - unspecified, this targetRef targets the entire resource. In the following - resources, SectionName is interpreted as the following: - - - * Gateway: Listener name - * HTTPRoute: HTTPRouteRule name - * Service: Port name - - - If a SectionName is specified, but does not exist on the targeted object, - the Policy must fail to attach, and the policy implementation should record - a `ResolvedRefs` or similar Condition in the Policy's status. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - group - - kind - - name - type: object - maxItems: 16 - minItems: 1 - type: array - validation: - description: Validation contains backend TLS validation configuration. - properties: - caCertificateRefs: - description: |- - CACertificateRefs contains one or more references to Kubernetes objects that - contain a PEM-encoded TLS CA certificate bundle, which is used to - validate a TLS handshake between the Gateway and backend Pod. - - - If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be - specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, - not both. If CACertifcateRefs is empty or unspecified, the configuration for - WellKnownCACertificates MUST be honored instead if supported by the implementation. - - - References to a resource in a different namespace are invalid for the - moment, although we will revisit this in the future. - - - A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support. - Implementations MAY choose to support attaching multiple certificates to - a backend, but this behavior is implementation-specific. - - - Support: Core - An optional single reference to a Kubernetes ConfigMap, - with the CA certificate in a key named `ca.crt`. - - - Support: Implementation-specific (More than one reference, or other kinds - of resources). - items: - description: |- - LocalObjectReference identifies an API object within the namespace of the - referrer. - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example "HTTPRoute" - or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - maxItems: 8 - type: array - hostname: - description: |- - Hostname is used for two purposes in the connection between Gateways and - backends: - - - 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). - 2. Hostname MUST be used for authentication and MUST match the certificate - served by the matching backend. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - wellKnownCACertificates: - description: |- - WellKnownCACertificates specifies whether system CA certificates may be used in - the TLS handshake between the gateway and backend pod. - - - If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs - must be specified with at least one entry for a valid configuration. Only one of - CACertificateRefs or WellKnownCACertificates may be specified, not both. If an - implementation does not support the WellKnownCACertificates field or the value - supplied is not supported, the Status Conditions on the Policy MUST be - updated to include an Accepted: False Condition with Reason: Invalid. - - - Support: Implementation-specific - enum: - - System - type: string - required: - - hostname - type: object - x-kubernetes-validations: - - message: must not contain both CACertificateRefs and WellKnownCACertificates - rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs) - > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates - != "")' - - message: must specify either CACertificateRefs or WellKnownCACertificates - rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs) - > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates - != "") - required: - - targetRefs - - validation - type: object - status: - description: Status defines the current state of BackendTLSPolicy. - properties: - ancestors: - description: |- - Ancestors is a list of ancestor resources (usually Gateways) that are - associated with the policy, and the status of the policy with respect to - each ancestor. When this policy attaches to a parent, the controller that - manages the parent and the ancestors MUST add an entry to this list when - the controller first sees the policy and SHOULD update the entry as - appropriate when the relevant ancestor is modified. - - - Note that choosing the relevant ancestor is left to the Policy designers; - an important part of Policy design is designing the right object level at - which to namespace this status. - - - Note also that implementations MUST ONLY populate ancestor status for - the Ancestor resources they are responsible for. Implementations MUST - use the ControllerName field to uniquely identify the entries in this list - that they are responsible for. - - - Note that to achieve this, the list of PolicyAncestorStatus structs - MUST be treated as a map with a composite key, made up of the AncestorRef - and ControllerName fields combined. - - - A maximum of 16 ancestors will be represented in this list. An empty list - means the Policy is not relevant for any ancestors. - - - If this slice is full, implementations MUST NOT add further entries. - Instead they MUST consider the policy unimplementable and signal that - on any related resources such as the ancestor that would be referenced - here. For example, if this list was full on BackendTLSPolicy, no - additional Gateways would be able to reference the Service targeted by - the BackendTLSPolicy. - items: - description: |- - PolicyAncestorStatus describes the status of a route with respect to an - associated Ancestor. - - - Ancestors refer to objects that are either the Target of a policy or above it - in terms of object hierarchy. For example, if a policy targets a Service, the - Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and - the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most - useful object to place Policy status on, so we recommend that implementations - SHOULD use Gateway as the PolicyAncestorStatus object unless the designers - have a _very_ good reason otherwise. - - - In the context of policy attachment, the Ancestor is used to distinguish which - resource results in a distinct application of this policy. For example, if a policy - targets a Service, it may have a distinct result per attached Gateway. - - - Policies targeting the same resource may have different effects depending on the - ancestors of those resources. For example, different Gateways targeting the same - Service may have different capabilities, especially if they have different underlying - implementations. - - - For example, in BackendTLSPolicy, the Policy attaches to a Service that is - used as a backend in a HTTPRoute that is itself attached to a Gateway. - In this case, the relevant object for status is the Gateway, and that is the - ancestor object referred to in this status. - - - Note that a parent is also an ancestor, so for objects where the parent is the - relevant object for status, this struct SHOULD still be used. - - - This struct is intended to be used in a slice that's effectively a map, - with a composite key made up of the AncestorRef and the ControllerName. - properties: - ancestorRef: - description: |- - AncestorRef corresponds with a ParentRef in the spec that this - PolicyAncestorStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - conditions: - description: Conditions describes the status of the Policy with - respect to the given Ancestor. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - required: - - ancestorRef - - controllerName - type: object - maxItems: 16 - type: array - required: - - ancestors - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: gatewayclasses.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: GatewayClass - listKind: GatewayClassList - plural: gatewayclasses - shortNames: - - gc - singular: gatewayclass - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .spec.controllerName - name: Controller - type: string - - jsonPath: .status.conditions[?(@.type=="Accepted")].status - name: Accepted - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .spec.description - name: Description - priority: 1 - type: string - name: v1 - schema: - openAPIV3Schema: - description: |- - GatewayClass describes a class of Gateways available to the user for creating - Gateway resources. - - - It is recommended that this resource be used as a template for Gateways. This - means that a Gateway is based on the state of the GatewayClass at the time it - was created and changes to the GatewayClass or associated parameters are not - propagated down to existing Gateways. This recommendation is intended to - limit the blast radius of changes to GatewayClass or associated parameters. - If implementations choose to propagate GatewayClass changes to existing - Gateways, that MUST be clearly documented by the implementation. - - - Whenever one or more Gateways are using a GatewayClass, implementations SHOULD - add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the - associated GatewayClass. This ensures that a GatewayClass associated with a - Gateway is not deleted while in use. - - - GatewayClass is a Cluster level resource. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GatewayClass. - properties: - controllerName: - description: |- - ControllerName is the name of the controller that is managing Gateways of - this class. The value of this field MUST be a domain prefixed path. - - - Example: "example.net/gateway-controller". - - - This field is not mutable and cannot be empty. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - description: - description: Description helps describe a GatewayClass with more details. - maxLength: 64 - type: string - parametersRef: - description: |- - ParametersRef is a reference to a resource that contains the configuration - parameters corresponding to the GatewayClass. This is optional if the - controller does not require any additional configuration. - - - ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, - or an implementation-specific custom resource. The resource can be - cluster-scoped or namespace-scoped. - - - If the referent cannot be found, the GatewayClass's "InvalidParameters" - status condition will be true. - - - A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, - the merging behavior is implementation specific. - It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. - - - Support: Implementation-specific - properties: - group: - description: Group is the group of the referent. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - This field is required when referring to a Namespace-scoped resource and - MUST be unset when referring to a Cluster-scoped resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - name - type: object - required: - - controllerName - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Waiting - status: Unknown - type: Accepted - description: |- - Status defines the current state of GatewayClass. - - - Implementations MUST populate status on all GatewayClass resources which - specify their controller name. - properties: - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - description: |- - Conditions is the current status from the controller for - this GatewayClass. - - - Controllers should prefer to publish conditions using values - of GatewayClassConditionType for the type of each Condition. - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - supportedFeatures: - description: | - SupportedFeatures is the set of features the GatewayClass support. - It MUST be sorted in ascending alphabetical order. - items: - description: |- - SupportedFeature is used to describe distinct features that are covered by - conformance tests. - type: string - maxItems: 64 - type: array - x-kubernetes-list-type: set - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.controllerName - name: Controller - type: string - - jsonPath: .status.conditions[?(@.type=="Accepted")].status - name: Accepted - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .spec.description - name: Description - priority: 1 - type: string - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - GatewayClass describes a class of Gateways available to the user for creating - Gateway resources. - - - It is recommended that this resource be used as a template for Gateways. This - means that a Gateway is based on the state of the GatewayClass at the time it - was created and changes to the GatewayClass or associated parameters are not - propagated down to existing Gateways. This recommendation is intended to - limit the blast radius of changes to GatewayClass or associated parameters. - If implementations choose to propagate GatewayClass changes to existing - Gateways, that MUST be clearly documented by the implementation. - - - Whenever one or more Gateways are using a GatewayClass, implementations SHOULD - add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the - associated GatewayClass. This ensures that a GatewayClass associated with a - Gateway is not deleted while in use. - - - GatewayClass is a Cluster level resource. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GatewayClass. - properties: - controllerName: - description: |- - ControllerName is the name of the controller that is managing Gateways of - this class. The value of this field MUST be a domain prefixed path. - - - Example: "example.net/gateway-controller". - - - This field is not mutable and cannot be empty. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - description: - description: Description helps describe a GatewayClass with more details. - maxLength: 64 - type: string - parametersRef: - description: |- - ParametersRef is a reference to a resource that contains the configuration - parameters corresponding to the GatewayClass. This is optional if the - controller does not require any additional configuration. - - - ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, - or an implementation-specific custom resource. The resource can be - cluster-scoped or namespace-scoped. - - - If the referent cannot be found, the GatewayClass's "InvalidParameters" - status condition will be true. - - - A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, - the merging behavior is implementation specific. - It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. - - - Support: Implementation-specific - properties: - group: - description: Group is the group of the referent. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - This field is required when referring to a Namespace-scoped resource and - MUST be unset when referring to a Cluster-scoped resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - name - type: object - required: - - controllerName - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Waiting - status: Unknown - type: Accepted - description: |- - Status defines the current state of GatewayClass. - - - Implementations MUST populate status on all GatewayClass resources which - specify their controller name. - properties: - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - description: |- - Conditions is the current status from the controller for - this GatewayClass. - - - Controllers should prefer to publish conditions using values - of GatewayClassConditionType for the type of each Condition. - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - supportedFeatures: - description: | - SupportedFeatures is the set of features the GatewayClass support. - It MUST be sorted in ascending alphabetical order. - items: - description: |- - SupportedFeature is used to describe distinct features that are covered by - conformance tests. - type: string - maxItems: 64 - type: array - x-kubernetes-list-type: set - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_gateways.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: gateways.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: Gateway - listKind: GatewayList - plural: gateways - shortNames: - - gtw - singular: gateway - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.gatewayClassName - name: Class - type: string - - jsonPath: .status.addresses[*].value - name: Address - type: string - - jsonPath: .status.conditions[?(@.type=="Programmed")].status - name: Programmed - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - Gateway represents an instance of a service-traffic handling infrastructure - by binding Listeners to a set of IP addresses. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of Gateway. - properties: - addresses: - description: |+ - Addresses requested for this Gateway. This is optional and behavior can - depend on the implementation. If a value is set in the spec and the - requested address is invalid or unavailable, the implementation MUST - indicate this in the associated entry in GatewayStatus.Addresses. - - - The Addresses field represents a request for the address(es) on the - "outside of the Gateway", that traffic bound for this Gateway will use. - This could be the IP address or hostname of an external load balancer or - other networking infrastructure, or some other address that traffic will - be sent to. - - - If no Addresses are specified, the implementation MAY schedule the - Gateway in an implementation-specific manner, assigning an appropriate - set of Addresses. - - - The implementation MUST bind all Listeners to every GatewayAddress that - it assigns to the Gateway and add a corresponding entry in - GatewayStatus.Addresses. - - - Support: Extended - - - items: - description: GatewayAddress describes an address that can be bound - to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: IPAddress values must be unique - rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - - message: Hostname values must be unique - rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - gatewayClassName: - description: |- - GatewayClassName used for this Gateway. This is the name of a - GatewayClass resource. - maxLength: 253 - minLength: 1 - type: string - infrastructure: - description: |+ - Infrastructure defines infrastructure level attributes about this Gateway instance. - - - Support: Core - - - properties: - annotations: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Annotations that SHOULD be applied to any resources created in response to this Gateway. - - - For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources. - For other implementations, this refers to any relevant (implementation specific) "annotations" concepts. - - - An implementation may chose to add additional implementation-specific annotations as they see fit. - - - Support: Extended - maxProperties: 8 - type: object - labels: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Labels that SHOULD be applied to any resources created in response to this Gateway. - - - For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources. - For other implementations, this refers to any relevant (implementation specific) "labels" concepts. - - - An implementation may chose to add additional implementation-specific labels as they see fit. - - - Support: Extended - maxProperties: 8 - type: object - parametersRef: - description: |- - ParametersRef is a reference to a resource that contains the configuration - parameters corresponding to the Gateway. This is optional if the - controller does not require any additional configuration. - - - This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis - - - The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified, - the merging behavior is implementation specific. - It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. - - - Support: Implementation-specific - properties: - group: - description: Group is the group of the referent. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - type: object - listeners: - description: |- - Listeners associated with this Gateway. Listeners define - logical endpoints that are bound on this Gateway's addresses. - At least one Listener MUST be specified. - - - Each Listener in a set of Listeners (for example, in a single Gateway) - MUST be _distinct_, in that a traffic flow MUST be able to be assigned to - exactly one listener. (This section uses "set of Listeners" rather than - "Listeners in a single Gateway" because implementations MAY merge configuration - from multiple Gateways onto a single data plane, and these rules _also_ - apply in that case). - - - Practically, this means that each listener in a set MUST have a unique - combination of Port, Protocol, and, if supported by the protocol, Hostname. - - - Some combinations of port, protocol, and TLS settings are considered - Core support and MUST be supported by implementations based on their - targeted conformance profile: - - - HTTP Profile - - - 1. HTTPRoute, Port: 80, Protocol: HTTP - 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided - - - TLS Profile - - - 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough - - - "Distinct" Listeners have the following property: - - - The implementation can match inbound requests to a single distinct - Listener. When multiple Listeners share values for fields (for - example, two Listeners with the same Port value), the implementation - can match requests to only one of the Listeners using other - Listener fields. - - - For example, the following Listener scenarios are distinct: - - - 1. Multiple Listeners with the same Port that all use the "HTTP" - Protocol that all have unique Hostname values. - 2. Multiple Listeners with the same Port that use either the "HTTPS" or - "TLS" Protocol that all have unique Hostname values. - 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener - with the same Protocol has the same Port value. - - - Some fields in the Listener struct have possible values that affect - whether the Listener is distinct. Hostname is particularly relevant - for HTTP or HTTPS protocols. - - - When using the Hostname value to select between same-Port, same-Protocol - Listeners, the Hostname value must be different on each Listener for the - Listener to be distinct. - - - When the Listeners are distinct based on Hostname, inbound request - hostnames MUST match from the most specific to least specific Hostname - values to choose the correct Listener and its associated set of Routes. - - - Exact matches must be processed before wildcard matches, and wildcard - matches must be processed before fallback (empty Hostname value) - matches. For example, `"foo.example.com"` takes precedence over - `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. - - - Additionally, if there are multiple wildcard entries, more specific - wildcard entries must be processed before less specific wildcard entries. - For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. - The precise definition here is that the higher the number of dots in the - hostname to the right of the wildcard character, the higher the precedence. - - - The wildcard character will match any number of characters _and dots_ to - the left, however, so `"*.example.com"` will match both - `"foo.bar.example.com"` _and_ `"bar.example.com"`. - - - If a set of Listeners contains Listeners that are not distinct, then those - Listeners are Conflicted, and the implementation MUST set the "Conflicted" - condition in the Listener Status to "True". - - - Implementations MAY choose to accept a Gateway with some Conflicted - Listeners only if they only accept the partial Listener set that contains - no Conflicted Listeners. To put this another way, implementations may - accept a partial Listener set only if they throw out *all* the conflicting - Listeners. No picking one of the conflicting listeners as the winner. - This also means that the Gateway must have at least one non-conflicting - Listener in this case, otherwise it violates the requirement that at - least one Listener must be present. - - - The implementation MUST set a "ListenersNotValid" condition on the - Gateway Status when the Gateway contains Conflicted Listeners whether or - not they accept the Gateway. That Condition SHOULD clearly - indicate in the Message which Listeners are conflicted, and which are - Accepted. Additionally, the Listener status for those listeners SHOULD - indicate which Listeners are conflicted and not Accepted. - - - A Gateway's Listeners are considered "compatible" if: - - - 1. They are distinct. - 2. The implementation can serve them in compliance with the Addresses - requirement that all Listeners are available on all assigned - addresses. - - - Compatible combinations in Extended support are expected to vary across - implementations. A combination that is compatible for one implementation - may not be compatible for another. - - - For example, an implementation that cannot serve both TCP and UDP listeners - on the same address, or cannot mix HTTPS and generic TLS listens on the same port - would not consider those cases compatible, even though they are distinct. - - - Note that requests SHOULD match at most one Listener. For example, if - Listeners are defined for "foo.example.com" and "*.example.com", a - request to "foo.example.com" SHOULD only be routed using routes attached - to the "foo.example.com" Listener (and not the "*.example.com" Listener). - This concept is known as "Listener Isolation". Implementations that do - not support Listener Isolation MUST clearly document this. - - - Implementations MAY merge separate Gateways onto a single set of - Addresses if all Listeners across all Gateways are compatible. - - - Support: Core - items: - description: |- - Listener embodies the concept of a logical endpoint where a Gateway accepts - network connections. - properties: - allowedRoutes: - default: - namespaces: - from: Same - description: |- - AllowedRoutes defines the types of routes that MAY be attached to a - Listener and the trusted namespaces where those Route resources MAY be - present. - - - Although a client request may match multiple route rules, only one rule - may ultimately receive the request. Matching precedence MUST be - determined in order of the following criteria: - - - * The most specific match as defined by the Route type. - * The oldest Route based on creation timestamp. For example, a Route with - a creation timestamp of "2020-09-08 01:02:03" is given precedence over - a Route with a creation timestamp of "2020-09-08 01:02:04". - * If everything else is equivalent, the Route appearing first in - alphabetical order (namespace/name) should be given precedence. For - example, foo/bar is given precedence over foo/baz. - - - All valid rules within a Route attached to this Listener should be - implemented. Invalid Route rules can be ignored (sometimes that will mean - the full Route). If a Route rule transitions from valid to invalid, - support for that Route rule should be dropped to ensure consistency. For - example, even if a filter specified by a Route rule is invalid, the rest - of the rules within that Route should still be supported. - - - Support: Core - properties: - kinds: - description: |- - Kinds specifies the groups and kinds of Routes that are allowed to bind - to this Gateway Listener. When unspecified or empty, the kinds of Routes - selected are determined using the Listener protocol. - - - A RouteGroupKind MUST correspond to kinds of Routes that are compatible - with the application protocol specified in the Listener's Protocol field. - If an implementation does not support or recognize this resource type, it - MUST set the "ResolvedRefs" condition to False for this Listener with the - "InvalidRouteKinds" reason. - - - Support: Core - items: - description: RouteGroupKind indicates the group and kind - of a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - namespaces: - default: - from: Same - description: |- - Namespaces indicates namespaces from which Routes may be attached to this - Listener. This is restricted to the namespace of this Gateway by default. - - - Support: Core - properties: - from: - default: Same - description: |- - From indicates where Routes will be selected for this Gateway. Possible - values are: - - - * All: Routes in all namespaces may be used by this Gateway. - * Selector: Routes in namespaces selected by the selector may be used by - this Gateway. - * Same: Only Routes in the same namespace may be used by this Gateway. - - - Support: Core - enum: - - All - - Selector - - Same - type: string - selector: - description: |- - Selector must be specified when From is set to "Selector". In that case, - only Routes in Namespaces matching this Selector will be selected by this - Gateway. This field is ignored for other values of "From". - - - Support: Core - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: object - hostname: - description: |- - Hostname specifies the virtual hostname to match for protocol types that - define this concept. When unspecified, all hostnames are matched. This - field is ignored for protocols that don't require hostname based - matching. - - - Implementations MUST apply Hostname matching appropriately for each of - the following protocols: - - - * TLS: The Listener Hostname MUST match the SNI. - * HTTP: The Listener Hostname MUST match the Host header of the request. - * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP - protocol layers as described above. If an implementation does not - ensure that both the SNI and Host header match the Listener hostname, - it MUST clearly document that. - - - For HTTPRoute and TLSRoute resources, there is an interaction with the - `spec.hostnames` array. When both listener and route specify hostnames, - there MUST be an intersection between the values for a Route to be - accepted. For more information, refer to the Route specific Hostnames - documentation. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - name: - description: |- - Name is the name of the Listener. This name MUST be unique within a - Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - port: - description: |- - Port is the network port. Multiple listeners may use the - same port, subject to the Listener compatibility rules. - - - Support: Core - format: int32 - maximum: 65535 - minimum: 1 - type: integer - protocol: - description: |- - Protocol specifies the network protocol this listener expects to receive. - - - Support: Core - maxLength: 255 - minLength: 1 - pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ - type: string - tls: - description: |- - TLS is the TLS configuration for the Listener. This field is required if - the Protocol field is "HTTPS" or "TLS". It is invalid to set this field - if the Protocol field is "HTTP", "TCP", or "UDP". - - - The association of SNIs to Certificate defined in GatewayTLSConfig is - defined based on the Hostname field for this listener. - - - The GatewayClass MUST use the longest matching SNI out of all - available certificates for any TLS handshake. - - - Support: Core - properties: - certificateRefs: - description: |- - CertificateRefs contains a series of references to Kubernetes objects that - contains TLS certificates and private keys. These certificates are used to - establish a TLS handshake for requests that match the hostname of the - associated listener. - - - A single CertificateRef to a Kubernetes Secret has "Core" support. - Implementations MAY choose to support attaching multiple certificates to - a Listener, but this behavior is implementation-specific. - - - References to a resource in different namespace are invalid UNLESS there - is a ReferenceGrant in the target namespace that allows the certificate - to be attached. If a ReferenceGrant does not allow this reference, the - "ResolvedRefs" condition MUST be set to False for this listener with the - "RefNotPermitted" reason. - - - This field is required to have at least one element when the mode is set - to "Terminate" (default) and is optional otherwise. - - - CertificateRefs can reference to standard Kubernetes resources, i.e. - Secret, or implementation-specific custom resources. - - - Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls - - - Support: Implementation-specific (More than one reference or other resource types) - items: - description: |- - SecretObjectReference identifies an API object including its namespace, - defaulting to Secret. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Secret - description: Kind is kind of the referent. For example - "Secret". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referenced object. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - name - type: object - maxItems: 64 - type: array - frontendValidation: - description: |+ - FrontendValidation holds configuration information for validating the frontend (client). - Setting this field will require clients to send a client certificate - required for validation during the TLS handshake. In browsers this may result in a dialog appearing - that requests a user to specify the client certificate. - The maximum depth of a certificate chain accepted in verification is Implementation specific. - - - Support: Extended - - - properties: - caCertificateRefs: - description: |- - CACertificateRefs contains one or more references to - Kubernetes objects that contain TLS certificates of - the Certificate Authorities that can be used - as a trust anchor to validate the certificates presented by the client. - - - A single CA certificate reference to a Kubernetes ConfigMap - has "Core" support. - Implementations MAY choose to support attaching multiple CA certificates to - a Listener, but this behavior is implementation-specific. - - - Support: Core - A single reference to a Kubernetes ConfigMap - with the CA certificate in a key named `ca.crt`. - - - Support: Implementation-specific (More than one reference, or other kinds - of resources). - - - References to a resource in a different namespace are invalid UNLESS there - is a ReferenceGrant in the target namespace that allows the certificate - to be attached. If a ReferenceGrant does not allow this reference, the - "ResolvedRefs" condition MUST be set to False for this listener with the - "RefNotPermitted" reason. - items: - description: |- - ObjectReference identifies an API object including its namespace. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "ConfigMap" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referenced object. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - name - type: object - maxItems: 8 - minItems: 1 - type: array - type: object - mode: - default: Terminate - description: |- - Mode defines the TLS behavior for the TLS session initiated by the client. - There are two possible modes: - - - - Terminate: The TLS session between the downstream client and the - Gateway is terminated at the Gateway. This mode requires certificates - to be specified in some way, such as populating the certificateRefs - field. - - Passthrough: The TLS session is NOT terminated by the Gateway. This - implies that the Gateway can't decipher the TLS stream except for - the ClientHello message of the TLS protocol. The certificateRefs field - is ignored in this mode. - - - Support: Core - enum: - - Terminate - - Passthrough - type: string - options: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Options are a list of key/value pairs to enable extended TLS - configuration for each implementation. For example, configuring the - minimum TLS version or supported cipher suites. - - - A set of common keys MAY be defined by the API in the future. To avoid - any ambiguity, implementation-specific definitions MUST use - domain-prefixed names, such as `example.com/my-custom-option`. - Un-prefixed names are reserved for key names defined by Gateway API. - - - Support: Implementation-specific - maxProperties: 16 - type: object - type: object - x-kubernetes-validations: - - message: certificateRefs or options must be specified when - mode is Terminate - rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) - > 0 || size(self.options) > 0 : true' - required: - - name - - port - - protocol - type: object - maxItems: 64 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: tls must not be specified for protocols ['HTTP', 'TCP', - 'UDP'] - rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? - !has(l.tls) : true)' - - message: tls mode must be Terminate for protocol HTTPS - rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode - == '''' || l.tls.mode == ''Terminate'') : true)' - - message: hostname must not be specified for protocols ['TCP', 'UDP'] - rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) - || l.hostname == '''') : true)' - - message: Listener name must be unique within the Gateway - rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) - - message: Combination of port, protocol and hostname must be unique - for each listener - rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol - == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname - == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' - required: - - gatewayClassName - - listeners - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: Status defines the current state of Gateway. - properties: - addresses: - description: |+ - Addresses lists the network addresses that have been bound to the - Gateway. - - - This list may differ from the addresses provided in the spec under some - conditions: - - - * no addresses are specified, all addresses are dynamically assigned - * a combination of specified and dynamic addresses are assigned - * a specified address was unusable (e.g. already in use) - - - items: - description: GatewayStatusAddress describes a network address that - is bound to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: |- - Conditions describe the current conditions of the Gateway. - - - Implementations should prefer to express Gateway conditions - using the `GatewayConditionType` and `GatewayConditionReason` - constants so that operators and tools can converge on a common - vocabulary to describe Gateway state. - - - Known condition types are: - - - * "Accepted" - * "Programmed" - * "Ready" - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - listeners: - description: Listeners provide status for each unique listener port - defined in the Spec. - items: - description: ListenerStatus is the status associated with a Listener. - properties: - attachedRoutes: - description: |- - AttachedRoutes represents the total number of Routes that have been - successfully attached to this Listener. - - - Successful attachment of a Route to a Listener is based solely on the - combination of the AllowedRoutes field on the corresponding Listener - and the Route's ParentRefs field. A Route is successfully attached to - a Listener when it is selected by the Listener's AllowedRoutes field - AND the Route has a valid ParentRef selecting the whole Gateway - resource or a specific Listener as a parent resource (more detail on - attachment semantics can be found in the documentation on the various - Route kinds ParentRefs fields). Listener or Route status does not impact - successful attachment, i.e. the AttachedRoutes field count MUST be set - for Listeners with condition Accepted: false and MUST count successfully - attached Routes that may themselves have Accepted: false conditions. - - - Uses for this field include troubleshooting Route attachment and - measuring blast radius/impact of changes to a Listener. - format: int32 - type: integer - conditions: - description: Conditions describe the current condition of this - listener. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - name: - description: Name is the name of the Listener that this status - corresponds to. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - supportedKinds: - description: |- - SupportedKinds is the list indicating the Kinds supported by this - listener. This MUST represent the kinds an implementation supports for - that Listener configuration. - - - If kinds are specified in Spec that are not supported, they MUST NOT - appear in this list and an implementation MUST set the "ResolvedRefs" - condition to "False" with the "InvalidRouteKinds" reason. If both valid - and invalid Route kinds are specified, the implementation MUST - reference the valid Route kinds that have been specified. - items: - description: RouteGroupKind indicates the group and kind of - a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - required: - - attachedRoutes - - conditions - - name - - supportedKinds - type: object - maxItems: 64 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.gatewayClassName - name: Class - type: string - - jsonPath: .status.addresses[*].value - name: Address - type: string - - jsonPath: .status.conditions[?(@.type=="Programmed")].status - name: Programmed - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - Gateway represents an instance of a service-traffic handling infrastructure - by binding Listeners to a set of IP addresses. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of Gateway. - properties: - addresses: - description: |+ - Addresses requested for this Gateway. This is optional and behavior can - depend on the implementation. If a value is set in the spec and the - requested address is invalid or unavailable, the implementation MUST - indicate this in the associated entry in GatewayStatus.Addresses. - - - The Addresses field represents a request for the address(es) on the - "outside of the Gateway", that traffic bound for this Gateway will use. - This could be the IP address or hostname of an external load balancer or - other networking infrastructure, or some other address that traffic will - be sent to. - - - If no Addresses are specified, the implementation MAY schedule the - Gateway in an implementation-specific manner, assigning an appropriate - set of Addresses. - - - The implementation MUST bind all Listeners to every GatewayAddress that - it assigns to the Gateway and add a corresponding entry in - GatewayStatus.Addresses. - - - Support: Extended - - - items: - description: GatewayAddress describes an address that can be bound - to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: IPAddress values must be unique - rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - - message: Hostname values must be unique - rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - gatewayClassName: - description: |- - GatewayClassName used for this Gateway. This is the name of a - GatewayClass resource. - maxLength: 253 - minLength: 1 - type: string - infrastructure: - description: |+ - Infrastructure defines infrastructure level attributes about this Gateway instance. - - - Support: Core - - - properties: - annotations: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Annotations that SHOULD be applied to any resources created in response to this Gateway. - - - For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources. - For other implementations, this refers to any relevant (implementation specific) "annotations" concepts. - - - An implementation may chose to add additional implementation-specific annotations as they see fit. - - - Support: Extended - maxProperties: 8 - type: object - labels: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Labels that SHOULD be applied to any resources created in response to this Gateway. - - - For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources. - For other implementations, this refers to any relevant (implementation specific) "labels" concepts. - - - An implementation may chose to add additional implementation-specific labels as they see fit. - - - Support: Extended - maxProperties: 8 - type: object - parametersRef: - description: |- - ParametersRef is a reference to a resource that contains the configuration - parameters corresponding to the Gateway. This is optional if the - controller does not require any additional configuration. - - - This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis - - - The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified, - the merging behavior is implementation specific. - It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. - - - Support: Implementation-specific - properties: - group: - description: Group is the group of the referent. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - type: object - listeners: - description: |- - Listeners associated with this Gateway. Listeners define - logical endpoints that are bound on this Gateway's addresses. - At least one Listener MUST be specified. - - - Each Listener in a set of Listeners (for example, in a single Gateway) - MUST be _distinct_, in that a traffic flow MUST be able to be assigned to - exactly one listener. (This section uses "set of Listeners" rather than - "Listeners in a single Gateway" because implementations MAY merge configuration - from multiple Gateways onto a single data plane, and these rules _also_ - apply in that case). - - - Practically, this means that each listener in a set MUST have a unique - combination of Port, Protocol, and, if supported by the protocol, Hostname. - - - Some combinations of port, protocol, and TLS settings are considered - Core support and MUST be supported by implementations based on their - targeted conformance profile: - - - HTTP Profile - - - 1. HTTPRoute, Port: 80, Protocol: HTTP - 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided - - - TLS Profile - - - 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough - - - "Distinct" Listeners have the following property: - - - The implementation can match inbound requests to a single distinct - Listener. When multiple Listeners share values for fields (for - example, two Listeners with the same Port value), the implementation - can match requests to only one of the Listeners using other - Listener fields. - - - For example, the following Listener scenarios are distinct: - - - 1. Multiple Listeners with the same Port that all use the "HTTP" - Protocol that all have unique Hostname values. - 2. Multiple Listeners with the same Port that use either the "HTTPS" or - "TLS" Protocol that all have unique Hostname values. - 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener - with the same Protocol has the same Port value. - - - Some fields in the Listener struct have possible values that affect - whether the Listener is distinct. Hostname is particularly relevant - for HTTP or HTTPS protocols. - - - When using the Hostname value to select between same-Port, same-Protocol - Listeners, the Hostname value must be different on each Listener for the - Listener to be distinct. - - - When the Listeners are distinct based on Hostname, inbound request - hostnames MUST match from the most specific to least specific Hostname - values to choose the correct Listener and its associated set of Routes. - - - Exact matches must be processed before wildcard matches, and wildcard - matches must be processed before fallback (empty Hostname value) - matches. For example, `"foo.example.com"` takes precedence over - `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. - - - Additionally, if there are multiple wildcard entries, more specific - wildcard entries must be processed before less specific wildcard entries. - For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. - The precise definition here is that the higher the number of dots in the - hostname to the right of the wildcard character, the higher the precedence. - - - The wildcard character will match any number of characters _and dots_ to - the left, however, so `"*.example.com"` will match both - `"foo.bar.example.com"` _and_ `"bar.example.com"`. - - - If a set of Listeners contains Listeners that are not distinct, then those - Listeners are Conflicted, and the implementation MUST set the "Conflicted" - condition in the Listener Status to "True". - - - Implementations MAY choose to accept a Gateway with some Conflicted - Listeners only if they only accept the partial Listener set that contains - no Conflicted Listeners. To put this another way, implementations may - accept a partial Listener set only if they throw out *all* the conflicting - Listeners. No picking one of the conflicting listeners as the winner. - This also means that the Gateway must have at least one non-conflicting - Listener in this case, otherwise it violates the requirement that at - least one Listener must be present. - - - The implementation MUST set a "ListenersNotValid" condition on the - Gateway Status when the Gateway contains Conflicted Listeners whether or - not they accept the Gateway. That Condition SHOULD clearly - indicate in the Message which Listeners are conflicted, and which are - Accepted. Additionally, the Listener status for those listeners SHOULD - indicate which Listeners are conflicted and not Accepted. - - - A Gateway's Listeners are considered "compatible" if: - - - 1. They are distinct. - 2. The implementation can serve them in compliance with the Addresses - requirement that all Listeners are available on all assigned - addresses. - - - Compatible combinations in Extended support are expected to vary across - implementations. A combination that is compatible for one implementation - may not be compatible for another. - - - For example, an implementation that cannot serve both TCP and UDP listeners - on the same address, or cannot mix HTTPS and generic TLS listens on the same port - would not consider those cases compatible, even though they are distinct. - - - Note that requests SHOULD match at most one Listener. For example, if - Listeners are defined for "foo.example.com" and "*.example.com", a - request to "foo.example.com" SHOULD only be routed using routes attached - to the "foo.example.com" Listener (and not the "*.example.com" Listener). - This concept is known as "Listener Isolation". Implementations that do - not support Listener Isolation MUST clearly document this. - - - Implementations MAY merge separate Gateways onto a single set of - Addresses if all Listeners across all Gateways are compatible. - - - Support: Core - items: - description: |- - Listener embodies the concept of a logical endpoint where a Gateway accepts - network connections. - properties: - allowedRoutes: - default: - namespaces: - from: Same - description: |- - AllowedRoutes defines the types of routes that MAY be attached to a - Listener and the trusted namespaces where those Route resources MAY be - present. - - - Although a client request may match multiple route rules, only one rule - may ultimately receive the request. Matching precedence MUST be - determined in order of the following criteria: - - - * The most specific match as defined by the Route type. - * The oldest Route based on creation timestamp. For example, a Route with - a creation timestamp of "2020-09-08 01:02:03" is given precedence over - a Route with a creation timestamp of "2020-09-08 01:02:04". - * If everything else is equivalent, the Route appearing first in - alphabetical order (namespace/name) should be given precedence. For - example, foo/bar is given precedence over foo/baz. - - - All valid rules within a Route attached to this Listener should be - implemented. Invalid Route rules can be ignored (sometimes that will mean - the full Route). If a Route rule transitions from valid to invalid, - support for that Route rule should be dropped to ensure consistency. For - example, even if a filter specified by a Route rule is invalid, the rest - of the rules within that Route should still be supported. - - - Support: Core - properties: - kinds: - description: |- - Kinds specifies the groups and kinds of Routes that are allowed to bind - to this Gateway Listener. When unspecified or empty, the kinds of Routes - selected are determined using the Listener protocol. - - - A RouteGroupKind MUST correspond to kinds of Routes that are compatible - with the application protocol specified in the Listener's Protocol field. - If an implementation does not support or recognize this resource type, it - MUST set the "ResolvedRefs" condition to False for this Listener with the - "InvalidRouteKinds" reason. - - - Support: Core - items: - description: RouteGroupKind indicates the group and kind - of a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - namespaces: - default: - from: Same - description: |- - Namespaces indicates namespaces from which Routes may be attached to this - Listener. This is restricted to the namespace of this Gateway by default. - - - Support: Core - properties: - from: - default: Same - description: |- - From indicates where Routes will be selected for this Gateway. Possible - values are: - - - * All: Routes in all namespaces may be used by this Gateway. - * Selector: Routes in namespaces selected by the selector may be used by - this Gateway. - * Same: Only Routes in the same namespace may be used by this Gateway. - - - Support: Core - enum: - - All - - Selector - - Same - type: string - selector: - description: |- - Selector must be specified when From is set to "Selector". In that case, - only Routes in Namespaces matching this Selector will be selected by this - Gateway. This field is ignored for other values of "From". - - - Support: Core - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: object - hostname: - description: |- - Hostname specifies the virtual hostname to match for protocol types that - define this concept. When unspecified, all hostnames are matched. This - field is ignored for protocols that don't require hostname based - matching. - - - Implementations MUST apply Hostname matching appropriately for each of - the following protocols: - - - * TLS: The Listener Hostname MUST match the SNI. - * HTTP: The Listener Hostname MUST match the Host header of the request. - * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP - protocol layers as described above. If an implementation does not - ensure that both the SNI and Host header match the Listener hostname, - it MUST clearly document that. - - - For HTTPRoute and TLSRoute resources, there is an interaction with the - `spec.hostnames` array. When both listener and route specify hostnames, - there MUST be an intersection between the values for a Route to be - accepted. For more information, refer to the Route specific Hostnames - documentation. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - name: - description: |- - Name is the name of the Listener. This name MUST be unique within a - Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - port: - description: |- - Port is the network port. Multiple listeners may use the - same port, subject to the Listener compatibility rules. - - - Support: Core - format: int32 - maximum: 65535 - minimum: 1 - type: integer - protocol: - description: |- - Protocol specifies the network protocol this listener expects to receive. - - - Support: Core - maxLength: 255 - minLength: 1 - pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ - type: string - tls: - description: |- - TLS is the TLS configuration for the Listener. This field is required if - the Protocol field is "HTTPS" or "TLS". It is invalid to set this field - if the Protocol field is "HTTP", "TCP", or "UDP". - - - The association of SNIs to Certificate defined in GatewayTLSConfig is - defined based on the Hostname field for this listener. - - - The GatewayClass MUST use the longest matching SNI out of all - available certificates for any TLS handshake. - - - Support: Core - properties: - certificateRefs: - description: |- - CertificateRefs contains a series of references to Kubernetes objects that - contains TLS certificates and private keys. These certificates are used to - establish a TLS handshake for requests that match the hostname of the - associated listener. - - - A single CertificateRef to a Kubernetes Secret has "Core" support. - Implementations MAY choose to support attaching multiple certificates to - a Listener, but this behavior is implementation-specific. - - - References to a resource in different namespace are invalid UNLESS there - is a ReferenceGrant in the target namespace that allows the certificate - to be attached. If a ReferenceGrant does not allow this reference, the - "ResolvedRefs" condition MUST be set to False for this listener with the - "RefNotPermitted" reason. - - - This field is required to have at least one element when the mode is set - to "Terminate" (default) and is optional otherwise. - - - CertificateRefs can reference to standard Kubernetes resources, i.e. - Secret, or implementation-specific custom resources. - - - Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls - - - Support: Implementation-specific (More than one reference or other resource types) - items: - description: |- - SecretObjectReference identifies an API object including its namespace, - defaulting to Secret. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Secret - description: Kind is kind of the referent. For example - "Secret". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referenced object. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - name - type: object - maxItems: 64 - type: array - frontendValidation: - description: |+ - FrontendValidation holds configuration information for validating the frontend (client). - Setting this field will require clients to send a client certificate - required for validation during the TLS handshake. In browsers this may result in a dialog appearing - that requests a user to specify the client certificate. - The maximum depth of a certificate chain accepted in verification is Implementation specific. - - - Support: Extended - - - properties: - caCertificateRefs: - description: |- - CACertificateRefs contains one or more references to - Kubernetes objects that contain TLS certificates of - the Certificate Authorities that can be used - as a trust anchor to validate the certificates presented by the client. - - - A single CA certificate reference to a Kubernetes ConfigMap - has "Core" support. - Implementations MAY choose to support attaching multiple CA certificates to - a Listener, but this behavior is implementation-specific. - - - Support: Core - A single reference to a Kubernetes ConfigMap - with the CA certificate in a key named `ca.crt`. - - - Support: Implementation-specific (More than one reference, or other kinds - of resources). - - - References to a resource in a different namespace are invalid UNLESS there - is a ReferenceGrant in the target namespace that allows the certificate - to be attached. If a ReferenceGrant does not allow this reference, the - "ResolvedRefs" condition MUST be set to False for this listener with the - "RefNotPermitted" reason. - items: - description: |- - ObjectReference identifies an API object including its namespace. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "ConfigMap" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referenced object. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - name - type: object - maxItems: 8 - minItems: 1 - type: array - type: object - mode: - default: Terminate - description: |- - Mode defines the TLS behavior for the TLS session initiated by the client. - There are two possible modes: - - - - Terminate: The TLS session between the downstream client and the - Gateway is terminated at the Gateway. This mode requires certificates - to be specified in some way, such as populating the certificateRefs - field. - - Passthrough: The TLS session is NOT terminated by the Gateway. This - implies that the Gateway can't decipher the TLS stream except for - the ClientHello message of the TLS protocol. The certificateRefs field - is ignored in this mode. - - - Support: Core - enum: - - Terminate - - Passthrough - type: string - options: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Options are a list of key/value pairs to enable extended TLS - configuration for each implementation. For example, configuring the - minimum TLS version or supported cipher suites. - - - A set of common keys MAY be defined by the API in the future. To avoid - any ambiguity, implementation-specific definitions MUST use - domain-prefixed names, such as `example.com/my-custom-option`. - Un-prefixed names are reserved for key names defined by Gateway API. - - - Support: Implementation-specific - maxProperties: 16 - type: object - type: object - x-kubernetes-validations: - - message: certificateRefs or options must be specified when - mode is Terminate - rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) - > 0 || size(self.options) > 0 : true' - required: - - name - - port - - protocol - type: object - maxItems: 64 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: tls must not be specified for protocols ['HTTP', 'TCP', - 'UDP'] - rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? - !has(l.tls) : true)' - - message: tls mode must be Terminate for protocol HTTPS - rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode - == '''' || l.tls.mode == ''Terminate'') : true)' - - message: hostname must not be specified for protocols ['TCP', 'UDP'] - rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) - || l.hostname == '''') : true)' - - message: Listener name must be unique within the Gateway - rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) - - message: Combination of port, protocol and hostname must be unique - for each listener - rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol - == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname - == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' - required: - - gatewayClassName - - listeners - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: Status defines the current state of Gateway. - properties: - addresses: - description: |+ - Addresses lists the network addresses that have been bound to the - Gateway. - - - This list may differ from the addresses provided in the spec under some - conditions: - - - * no addresses are specified, all addresses are dynamically assigned - * a combination of specified and dynamic addresses are assigned - * a specified address was unusable (e.g. already in use) - - - items: - description: GatewayStatusAddress describes a network address that - is bound to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: |- - Conditions describe the current conditions of the Gateway. - - - Implementations should prefer to express Gateway conditions - using the `GatewayConditionType` and `GatewayConditionReason` - constants so that operators and tools can converge on a common - vocabulary to describe Gateway state. - - - Known condition types are: - - - * "Accepted" - * "Programmed" - * "Ready" - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - listeners: - description: Listeners provide status for each unique listener port - defined in the Spec. - items: - description: ListenerStatus is the status associated with a Listener. - properties: - attachedRoutes: - description: |- - AttachedRoutes represents the total number of Routes that have been - successfully attached to this Listener. - - - Successful attachment of a Route to a Listener is based solely on the - combination of the AllowedRoutes field on the corresponding Listener - and the Route's ParentRefs field. A Route is successfully attached to - a Listener when it is selected by the Listener's AllowedRoutes field - AND the Route has a valid ParentRef selecting the whole Gateway - resource or a specific Listener as a parent resource (more detail on - attachment semantics can be found in the documentation on the various - Route kinds ParentRefs fields). Listener or Route status does not impact - successful attachment, i.e. the AttachedRoutes field count MUST be set - for Listeners with condition Accepted: false and MUST count successfully - attached Routes that may themselves have Accepted: false conditions. - - - Uses for this field include troubleshooting Route attachment and - measuring blast radius/impact of changes to a Listener. - format: int32 - type: integer - conditions: - description: Conditions describe the current condition of this - listener. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - name: - description: Name is the name of the Listener that this status - corresponds to. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - supportedKinds: - description: |- - SupportedKinds is the list indicating the Kinds supported by this - listener. This MUST represent the kinds an implementation supports for - that Listener configuration. - - - If kinds are specified in Spec that are not supported, they MUST NOT - appear in this list and an implementation MUST set the "ResolvedRefs" - condition to "False" with the "InvalidRouteKinds" reason. If both valid - and invalid Route kinds are specified, the implementation MUST - reference the valid Route kinds that have been specified. - items: - description: RouteGroupKind indicates the group and kind of - a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - required: - - attachedRoutes - - conditions - - name - - supportedKinds - type: object - maxItems: 64 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: grpcroutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: GRPCRoute - listKind: GRPCRouteList - plural: grpcroutes - singular: grpcroute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.hostnames - name: Hostnames - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - GRPCRoute provides a way to route gRPC requests. This includes the capability - to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header. - Filters can be used to specify additional processing steps. Backends specify - where matching requests will be routed. - - - GRPCRoute falls under extended support within the Gateway API. Within the - following specification, the word "MUST" indicates that an implementation - supporting GRPCRoute must conform to the indicated requirement, but an - implementation not supporting this route type need not follow the requirement - unless explicitly indicated. - - - Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST - accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via - ALPN. If the implementation does not support this, then it MUST set the - "Accepted" condition to "False" for the affected listener with a reason of - "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections - with an upgrade from HTTP/1. - - - Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST - support HTTP/2 over cleartext TCP (h2c, - https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial - upgrade from HTTP/1.1, i.e. with prior knowledge - (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation - does not support this, then it MUST set the "Accepted" condition to "False" - for the affected listener with a reason of "UnsupportedProtocol". - Implementations MAY also accept HTTP/2 connections with an upgrade from - HTTP/1, i.e. without prior knowledge. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GRPCRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames to match against the GRPC - Host header to select a GRPCRoute to process the request. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label MUST appear by itself as the first label. - - - If a hostname is specified by both the Listener and GRPCRoute, there - MUST be at least one intersecting hostname for the GRPCRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `test.example.com` and `*.example.com` would both match. On the other - hand, `example.com` and `test.example.net` would not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and GRPCRoute have specified hostnames, any - GRPCRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - GRPCRoute specified `test.example.com` and `test.example.net`, - `test.example.net` MUST NOT be considered for a match. - - - If both the Listener and GRPCRoute have specified hostnames, and none - match with the criteria above, then the GRPCRoute MUST NOT be accepted by - the implementation. The implementation MUST raise an 'Accepted' Condition - with a status of `False` in the corresponding RouteParentStatus. - - - If a Route (A) of type HTTPRoute or GRPCRoute is attached to a - Listener and that listener already has another Route (B) of the other - type attached and the intersection of the hostnames of A and B is - non-empty, then the implementation MUST accept exactly one of these two - routes, determined by the following criteria, in order: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - The rejected Route MUST raise an 'Accepted' condition with a status of - 'False' in the corresponding RouteParentStatus. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - description: Rules are a list of GRPC matchers, filters and actions. - items: - description: |- - GRPCRouteRule defines the semantics for matching a gRPC request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive an `UNAVAILABLE` status. - - - See the GRPCBackendRef definition for the rules about what makes a single - GRPCBackendRef invalid. - - - When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive an `UNAVAILABLE` status. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status. - Implementations may choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - GRPCBackendRef defines how a GRPCRoute forwards a gRPC request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level MUST be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in GRPCRouteRule.) - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - The effects of ordering of multiple behaviors are currently unspecified. - This can change in the future based on feedback during the alpha stage. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations that support - GRPCRoute. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - If an implementation can not support a combination of filters, it must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - matches: - description: |- - Matches define conditions used for matching the rule against incoming - gRPC requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - method: - service: foo.bar - headers: - values: - version: 2 - - method: - service: foo.bar.v2 - ``` - - - For a request to match against this rule, it MUST satisfy - EITHER of the two conditions: - - - - service of foo.bar AND contains the header `version: 2` - - service of foo.bar.v2 - - - See the documentation for GRPCRouteMatch on how to specify multiple - match conditions to be ANDed together. - - - If no matches are specified, the implementation MUST match every gRPC request. - - - Proxy or Load Balancer routing configuration generated from GRPCRoutes - MUST prioritize rules based on the following criteria, continuing on - ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes. - Precedence MUST be given to the rule with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - * Characters in a matching service. - * Characters in a matching method. - * Header matches. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within the Route that has been given precedence, - matching precedence MUST be granted to the first matching rule meeting - the above criteria. - items: - description: |- - GRPCRouteMatch defines the predicate used to match requests to a given - action. Multiple match types are ANDed together, i.e. the match will - evaluate to true only if all conditions are satisfied. - - - For example, the match below will match a gRPC request only if its service - is `foo` AND it contains the `version: v1` header: - - - ``` - matches: - - method: - type: Exact - service: "foo" - headers: - - name: "version" - value "v1" - - - ``` - properties: - headers: - description: |- - Headers specifies gRPC request header matchers. Multiple match values are - ANDed together, meaning, a request MUST match all the specified headers - to select the route. - items: - description: |- - GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request - headers. - properties: - name: - description: |- - Name is the name of the gRPC Header to be matched. - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: Type specifies how to match against - the value of the header. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of the gRPC Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies a gRPC request service/method matcher. If this field is - not specified, all services and methods will match. - properties: - method: - description: |- - Value of the method to match against. If left empty or omitted, will - match all services. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - service: - description: |- - Value of the service to match against. If left empty or omitted, will - match any service. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - type: - default: Exact - description: |- - Type specifies how to match against the service and/or method. - Support: Core (Exact with service and method specified) - - - Support: Implementation-specific (Exact with method specified but no service specified) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - RegularExpression - type: string - type: object - x-kubernetes-validations: - - message: One or both of 'service' or 'method' must be - specified - rule: 'has(self.type) ? has(self.service) || has(self.method) - : true' - - message: service must only contain valid characters - (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""): - true' - - message: method must only contain valid characters (matching - ^[A-Za-z_][A-Za-z_0-9]*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""): - true' - type: object - maxItems: 8 - type: array - sessionPersistence: - description: |+ - SessionPersistence defines and configures session persistence - for the route rule. - - - Support: Extended - - - properties: - absoluteTimeout: - description: |- - AbsoluteTimeout defines the absolute timeout of the persistent - session. Once the AbsoluteTimeout duration has elapsed, the - session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - cookieConfig: - description: |- - CookieConfig provides configuration settings that are specific - to cookie-based session persistence. - - - Support: Core - properties: - lifetimeType: - default: Session - description: |- - LifetimeType specifies whether the cookie has a permanent or - session-based lifetime. A permanent cookie persists until its - specified expiry time, defined by the Expires or Max-Age cookie - attributes, while a session cookie is deleted when the current - session ends. - - - When set to "Permanent", AbsoluteTimeout indicates the - cookie's lifetime via the Expires or Max-Age cookie attributes - and is required. - - - When set to "Session", AbsoluteTimeout indicates the - absolute lifetime of the cookie tracked by the gateway and - is optional. - - - Support: Core for "Session" type - - - Support: Extended for "Permanent" type - enum: - - Permanent - - Session - type: string - type: object - idleTimeout: - description: |- - IdleTimeout defines the idle timeout of the persistent session. - Once the session has been idle for more than the specified - IdleTimeout duration, the session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - sessionName: - description: |- - SessionName defines the name of the persistent session token - which may be reflected in the cookie or the header. Users - should avoid reusing session names to prevent unintended - consequences, such as rejection or unpredictable behavior. - - - Support: Implementation-specific - maxLength: 128 - type: string - type: - default: Cookie - description: |- - Type defines the type of session persistence such as through - the use a header or cookie. Defaults to cookie based session - persistence. - - - Support: Core for "Cookie" type - - - Support: Extended for "Header" type - enum: - - Cookie - - Header - type: string - type: object - x-kubernetes-validations: - - message: AbsoluteTimeout must be specified when cookie lifetimeType - is Permanent - rule: '!has(self.cookieConfig.lifetimeType) || self.cookieConfig.lifetimeType - != ''Permanent'' || has(self.absoluteTimeout)' - type: object - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of GRPCRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - type: object - served: true - storage: true - subresources: - status: {} - - deprecated: true - deprecationWarning: The v1alpha2 version of GRPCRoute has been deprecated and - will be removed in a future release of the API. Please upgrade to v1. - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - GRPCRoute provides a way to route gRPC requests. This includes the capability - to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header. - Filters can be used to specify additional processing steps. Backends specify - where matching requests will be routed. - - - GRPCRoute falls under extended support within the Gateway API. Within the - following specification, the word "MUST" indicates that an implementation - supporting GRPCRoute must conform to the indicated requirement, but an - implementation not supporting this route type need not follow the requirement - unless explicitly indicated. - - - Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST - accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via - ALPN. If the implementation does not support this, then it MUST set the - "Accepted" condition to "False" for the affected listener with a reason of - "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections - with an upgrade from HTTP/1. - - - Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST - support HTTP/2 over cleartext TCP (h2c, - https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial - upgrade from HTTP/1.1, i.e. with prior knowledge - (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation - does not support this, then it MUST set the "Accepted" condition to "False" - for the affected listener with a reason of "UnsupportedProtocol". - Implementations MAY also accept HTTP/2 connections with an upgrade from - HTTP/1, i.e. without prior knowledge. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GRPCRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames to match against the GRPC - Host header to select a GRPCRoute to process the request. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label MUST appear by itself as the first label. - - - If a hostname is specified by both the Listener and GRPCRoute, there - MUST be at least one intersecting hostname for the GRPCRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `test.example.com` and `*.example.com` would both match. On the other - hand, `example.com` and `test.example.net` would not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and GRPCRoute have specified hostnames, any - GRPCRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - GRPCRoute specified `test.example.com` and `test.example.net`, - `test.example.net` MUST NOT be considered for a match. - - - If both the Listener and GRPCRoute have specified hostnames, and none - match with the criteria above, then the GRPCRoute MUST NOT be accepted by - the implementation. The implementation MUST raise an 'Accepted' Condition - with a status of `False` in the corresponding RouteParentStatus. - - - If a Route (A) of type HTTPRoute or GRPCRoute is attached to a - Listener and that listener already has another Route (B) of the other - type attached and the intersection of the hostnames of A and B is - non-empty, then the implementation MUST accept exactly one of these two - routes, determined by the following criteria, in order: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - The rejected Route MUST raise an 'Accepted' condition with a status of - 'False' in the corresponding RouteParentStatus. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - description: Rules are a list of GRPC matchers, filters and actions. - items: - description: |- - GRPCRouteRule defines the semantics for matching a gRPC request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive an `UNAVAILABLE` status. - - - See the GRPCBackendRef definition for the rules about what makes a single - GRPCBackendRef invalid. - - - When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive an `UNAVAILABLE` status. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status. - Implementations may choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - GRPCBackendRef defines how a GRPCRoute forwards a gRPC request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level MUST be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in GRPCRouteRule.) - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - The effects of ordering of multiple behaviors are currently unspecified. - This can change in the future based on feedback during the alpha stage. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations that support - GRPCRoute. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - If an implementation can not support a combination of filters, it must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - matches: - description: |- - Matches define conditions used for matching the rule against incoming - gRPC requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - method: - service: foo.bar - headers: - values: - version: 2 - - method: - service: foo.bar.v2 - ``` - - - For a request to match against this rule, it MUST satisfy - EITHER of the two conditions: - - - - service of foo.bar AND contains the header `version: 2` - - service of foo.bar.v2 - - - See the documentation for GRPCRouteMatch on how to specify multiple - match conditions to be ANDed together. - - - If no matches are specified, the implementation MUST match every gRPC request. - - - Proxy or Load Balancer routing configuration generated from GRPCRoutes - MUST prioritize rules based on the following criteria, continuing on - ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes. - Precedence MUST be given to the rule with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - * Characters in a matching service. - * Characters in a matching method. - * Header matches. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within the Route that has been given precedence, - matching precedence MUST be granted to the first matching rule meeting - the above criteria. - items: - description: |- - GRPCRouteMatch defines the predicate used to match requests to a given - action. Multiple match types are ANDed together, i.e. the match will - evaluate to true only if all conditions are satisfied. - - - For example, the match below will match a gRPC request only if its service - is `foo` AND it contains the `version: v1` header: - - - ``` - matches: - - method: - type: Exact - service: "foo" - headers: - - name: "version" - value "v1" - - - ``` - properties: - headers: - description: |- - Headers specifies gRPC request header matchers. Multiple match values are - ANDed together, meaning, a request MUST match all the specified headers - to select the route. - items: - description: |- - GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request - headers. - properties: - name: - description: |- - Name is the name of the gRPC Header to be matched. - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: Type specifies how to match against - the value of the header. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of the gRPC Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies a gRPC request service/method matcher. If this field is - not specified, all services and methods will match. - properties: - method: - description: |- - Value of the method to match against. If left empty or omitted, will - match all services. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - service: - description: |- - Value of the service to match against. If left empty or omitted, will - match any service. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - type: - default: Exact - description: |- - Type specifies how to match against the service and/or method. - Support: Core (Exact with service and method specified) - - - Support: Implementation-specific (Exact with method specified but no service specified) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - RegularExpression - type: string - type: object - x-kubernetes-validations: - - message: One or both of 'service' or 'method' must be - specified - rule: 'has(self.type) ? has(self.service) || has(self.method) - : true' - - message: service must only contain valid characters - (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""): - true' - - message: method must only contain valid characters (matching - ^[A-Za-z_][A-Za-z_0-9]*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""): - true' - type: object - maxItems: 8 - type: array - sessionPersistence: - description: |+ - SessionPersistence defines and configures session persistence - for the route rule. - - - Support: Extended - - - properties: - absoluteTimeout: - description: |- - AbsoluteTimeout defines the absolute timeout of the persistent - session. Once the AbsoluteTimeout duration has elapsed, the - session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - cookieConfig: - description: |- - CookieConfig provides configuration settings that are specific - to cookie-based session persistence. - - - Support: Core - properties: - lifetimeType: - default: Session - description: |- - LifetimeType specifies whether the cookie has a permanent or - session-based lifetime. A permanent cookie persists until its - specified expiry time, defined by the Expires or Max-Age cookie - attributes, while a session cookie is deleted when the current - session ends. - - - When set to "Permanent", AbsoluteTimeout indicates the - cookie's lifetime via the Expires or Max-Age cookie attributes - and is required. - - - When set to "Session", AbsoluteTimeout indicates the - absolute lifetime of the cookie tracked by the gateway and - is optional. - - - Support: Core for "Session" type - - - Support: Extended for "Permanent" type - enum: - - Permanent - - Session - type: string - type: object - idleTimeout: - description: |- - IdleTimeout defines the idle timeout of the persistent session. - Once the session has been idle for more than the specified - IdleTimeout duration, the session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - sessionName: - description: |- - SessionName defines the name of the persistent session token - which may be reflected in the cookie or the header. Users - should avoid reusing session names to prevent unintended - consequences, such as rejection or unpredictable behavior. - - - Support: Implementation-specific - maxLength: 128 - type: string - type: - default: Cookie - description: |- - Type defines the type of session persistence such as through - the use a header or cookie. Defaults to cookie based session - persistence. - - - Support: Core for "Cookie" type - - - Support: Extended for "Header" type - enum: - - Cookie - - Header - type: string - type: object - x-kubernetes-validations: - - message: AbsoluteTimeout must be specified when cookie lifetimeType - is Permanent - rule: '!has(self.cookieConfig.lifetimeType) || self.cookieConfig.lifetimeType - != ''Permanent'' || has(self.absoluteTimeout)' - type: object - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of GRPCRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - type: object - served: true - storage: false -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: httproutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: HTTPRoute - listKind: HTTPRouteList - plural: httproutes - singular: httproute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.hostnames - name: Hostnames - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - HTTPRoute provides a way to route HTTP requests. This includes the capability - to match requests by hostname, path, header, or query param. Filters can be - used to specify additional processing steps. Backends specify where matching - requests should be routed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of HTTPRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames that should match against the HTTP Host - header to select a HTTPRoute used to process the request. Implementations - MUST ignore any port value specified in the HTTP Host header while - performing a match and (absent of any applicable header modification - configuration) MUST forward this header unmodified to the backend. - - - Valid values for Hostnames are determined by RFC 1123 definition of a - hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - If a hostname is specified by both the Listener and HTTPRoute, there - must be at least one intersecting hostname for the HTTPRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `*.example.com`, `test.example.com`, and `foo.test.example.com` would - all match. On the other hand, `example.com` and `test.example.net` would - not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and HTTPRoute have specified hostnames, any - HTTPRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - HTTPRoute specified `test.example.com` and `test.example.net`, - `test.example.net` must not be considered for a match. - - - If both the Listener and HTTPRoute have specified hostnames, and none - match with the criteria above, then the HTTPRoute is not accepted. The - implementation must raise an 'Accepted' Condition with a status of - `False` in the corresponding RouteParentStatus. - - - In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. - overlapping wildcard matching and exact matching hostnames), precedence must - be given to rules from the HTTPRoute with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - - - If ties exist across multiple Routes, the matching precedence rules for - HTTPRouteMatches takes over. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - default: - - matches: - - path: - type: PathPrefix - value: / - description: Rules are a list of HTTP matchers, filters and actions. - items: - description: |- - HTTPRouteRule defines semantics for matching an HTTP request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive a 500 status code. - - - See the HTTPBackendRef definition for the rules about what makes a single - HTTPBackendRef invalid. - - - When a HTTPBackendRef is invalid, 500 status codes MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive a 500 status code. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic must receive a 500. Implementations may - choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level should be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in HTTPRouteRule.) - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the - filter.type is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != - ''RequestRedirect'')' - - message: filter.requestRedirect must be specified - for RequestRedirect filter.type - rule: '!(!has(self.requestRedirect) && self.type == - ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() - <= 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - Wherever possible, implementations SHOULD implement filters in the order - they are specified. - - - Implementations MAY choose to implement this ordering strictly, rejecting - any combination or order of filters that can not be supported. If implementations - choose a strict interpretation of filter ordering, they MUST clearly document - that behavior. - - - To reject an invalid combination or order of filters, implementations SHOULD - consider the Route Rules with this configuration invalid. If all Route Rules - in a Route are invalid, the entire Route would be considered invalid. If only - a portion of Route Rules are invalid, implementations MUST set the - "PartiallyInvalid" condition for the Route. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - All filters are expected to be compatible with each other except for the - URLRewrite and RequestRedirect filters, which may not be combined. If an - implementation can not support other combinations of filters, they must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the filter.type - is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' - - message: filter.requestRedirect must be specified for RequestRedirect - filter.type - rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') && - self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() <= - 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 - matches: - default: - - path: - type: PathPrefix - value: / - description: |- - Matches define conditions used for matching the rule against incoming - HTTP requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - path: - value: "/foo" - headers: - - name: "version" - value: "v2" - - path: - value: "/v2/foo" - ``` - - - For a request to match against this rule, a request must satisfy - EITHER of the two conditions: - - - - path prefixed with `/foo` AND contains the header `version: v2` - - path prefix of `/v2/foo` - - - See the documentation for HTTPRouteMatch on how to specify multiple - match conditions that should be ANDed together. - - - If no matches are specified, the default is a prefix - path match on "/", which has the effect of matching every - HTTP request. - - - Proxy or Load Balancer routing configuration generated from HTTPRoutes - MUST prioritize matches based on the following criteria, continuing on - ties. Across all rules specified on applicable Routes, precedence must be - given to the match having: - - - * "Exact" path match. - * "Prefix" path match with largest number of characters. - * Method match. - * Largest number of header matches. - * Largest number of query param matches. - - - Note: The precedence of RegularExpression path matches are implementation-specific. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within an HTTPRoute, matching precedence MUST be granted - to the FIRST matching rule (in list order) with a match meeting the above - criteria. - - - When no rules matching a request have been successfully attached to the - parent a request is coming from, a HTTP 404 status code MUST be returned. - items: - description: "HTTPRouteMatch defines the predicate used to - match requests to a given\naction. Multiple match types - are ANDed together, i.e. the match will\nevaluate to true - only if all conditions are satisfied.\n\n\nFor example, - the match below will match a HTTP request only if its path\nstarts - with `/foo` AND it contains the `version: v1` header:\n\n\n```\nmatch:\n\n\n\tpath:\n\t - \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t - \ value \"v1\"\n\n\n```" - properties: - headers: - description: |- - Headers specifies HTTP request header matchers. Multiple match values are - ANDed together, meaning, a request must match all the specified headers - to select the route. - items: - description: |- - HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request - headers. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - - - When a header is repeated in an HTTP request, it is - implementation-specific behavior as to how this is represented. - Generally, proxies should follow the guidance from the RFC: - https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding - processing a repeated header, with special handling for "Set-Cookie". - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the header. - - - Support: Core (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression HeaderMatchType has implementation-specific - conformance, implementations can support POSIX, PCRE or any other dialects - of regular expressions. Please read the implementation's documentation to - determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP Header to - be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies HTTP method matcher. - When specified, this route will be matched only if the request has the - specified method. - - - Support: Extended - enum: - - GET - - HEAD - - POST - - PUT - - DELETE - - CONNECT - - OPTIONS - - TRACE - - PATCH - type: string - path: - default: - type: PathPrefix - value: / - description: |- - Path specifies a HTTP request path matcher. If this field is not - specified, a default prefix match on the "/" path is provided. - properties: - type: - default: PathPrefix - description: |- - Type specifies how to match against the path Value. - - - Support: Core (Exact, PathPrefix) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - PathPrefix - - RegularExpression - type: string - value: - default: / - description: Value of the HTTP path to match against. - maxLength: 1024 - type: string - type: object - x-kubernetes-validations: - - message: value must be an absolute path and start with - '/' when type one of ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') - : true' - - message: must not contain '//' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') - : true' - - message: must not contain '/./' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') - : true' - - message: must not contain '/../' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') - : true' - - message: must not contain '%2f' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') - : true' - - message: must not contain '%2F' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') - : true' - - message: must not contain '#' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') - : true' - - message: must not end with '/..' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') - : true' - - message: must not end with '/.' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') - : true' - - message: type must be one of ['Exact', 'PathPrefix', - 'RegularExpression'] - rule: self.type in ['Exact','PathPrefix'] || self.type - == 'RegularExpression' - - message: must only contain valid characters (matching - ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) - for types ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") - : true' - queryParams: - description: |- - QueryParams specifies HTTP query parameter matchers. Multiple match - values are ANDed together, meaning, a request must match all the - specified query parameters to select the route. - - - Support: Extended - items: - description: |- - HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP - query parameters. - properties: - name: - description: |- - Name is the name of the HTTP query param to be matched. This must be an - exact string match. (See - https://tools.ietf.org/html/rfc7230#section-2.7.3). - - - If multiple entries specify equivalent query param names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent query param name MUST be ignored. - - - If a query param is repeated in an HTTP request, the behavior is - purposely left undefined, since different data planes have different - capabilities. However, it is *recommended* that implementations should - match against the first value of the param if the data plane supports it, - as this behavior is expected in other load balancing contexts outside of - the Gateway API. - - - Users SHOULD NOT route traffic based on repeated query params to guard - themselves against potential differences in the implementations. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the query parameter. - - - Support: Extended (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression QueryParamMatchType has Implementation-specific - conformance, implementations can support POSIX, PCRE or any other - dialects of regular expressions. Please read the implementation's - documentation to determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP query param - to be matched. - maxLength: 1024 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - maxItems: 8 - type: array - sessionPersistence: - description: |+ - SessionPersistence defines and configures session persistence - for the route rule. - - - Support: Extended - - - properties: - absoluteTimeout: - description: |- - AbsoluteTimeout defines the absolute timeout of the persistent - session. Once the AbsoluteTimeout duration has elapsed, the - session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - cookieConfig: - description: |- - CookieConfig provides configuration settings that are specific - to cookie-based session persistence. - - - Support: Core - properties: - lifetimeType: - default: Session - description: |- - LifetimeType specifies whether the cookie has a permanent or - session-based lifetime. A permanent cookie persists until its - specified expiry time, defined by the Expires or Max-Age cookie - attributes, while a session cookie is deleted when the current - session ends. - - - When set to "Permanent", AbsoluteTimeout indicates the - cookie's lifetime via the Expires or Max-Age cookie attributes - and is required. - - - When set to "Session", AbsoluteTimeout indicates the - absolute lifetime of the cookie tracked by the gateway and - is optional. - - - Support: Core for "Session" type - - - Support: Extended for "Permanent" type - enum: - - Permanent - - Session - type: string - type: object - idleTimeout: - description: |- - IdleTimeout defines the idle timeout of the persistent session. - Once the session has been idle for more than the specified - IdleTimeout duration, the session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - sessionName: - description: |- - SessionName defines the name of the persistent session token - which may be reflected in the cookie or the header. Users - should avoid reusing session names to prevent unintended - consequences, such as rejection or unpredictable behavior. - - - Support: Implementation-specific - maxLength: 128 - type: string - type: - default: Cookie - description: |- - Type defines the type of session persistence such as through - the use a header or cookie. Defaults to cookie based session - persistence. - - - Support: Core for "Cookie" type - - - Support: Extended for "Header" type - enum: - - Cookie - - Header - type: string - type: object - x-kubernetes-validations: - - message: AbsoluteTimeout must be specified when cookie lifetimeType - is Permanent - rule: '!has(self.cookieConfig.lifetimeType) || self.cookieConfig.lifetimeType - != ''Permanent'' || has(self.absoluteTimeout)' - timeouts: - description: |+ - Timeouts defines the timeouts that can be configured for an HTTP request. - - - Support: Extended - - - properties: - backendRequest: - description: |- - BackendRequest specifies a timeout for an individual request from the gateway - to a backend. This covers the time from when the request first starts being - sent from the gateway to when the full response has been received from the backend. - - - Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout - completely. Implementations that cannot completely disable the timeout MUST - instead interpret the zero duration as the longest possible value to which - the timeout can be set. - - - An entire client HTTP transaction with a gateway, covered by the Request timeout, - may result in more than one call from the gateway to the destination backend, - for example, if automatic retries are supported. - - - Because the Request timeout encompasses the BackendRequest timeout, the value of - BackendRequest must be <= the value of Request timeout. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - request: - description: |- - Request specifies the maximum duration for a gateway to respond to an HTTP request. - If the gateway has not been able to respond before this deadline is met, the gateway - MUST return a timeout error. - - - For example, setting the `rules.timeouts.request` field to the value `10s` in an - `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds - to complete. - - - Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout - completely. Implementations that cannot completely disable the timeout MUST - instead interpret the zero duration as the longest possible value to which - the timeout can be set. - - - This timeout is intended to cover as close to the whole request-response transaction - as possible although an implementation MAY choose to start the timeout after the entire - request stream has been received instead of immediately after the transaction is - initiated by the client. - - - When this field is unspecified, request timeout behavior is implementation-specific. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - type: object - x-kubernetes-validations: - - message: backendRequest timeout cannot be longer than request - timeout - rule: '!(has(self.request) && has(self.backendRequest) && - duration(self.request) != duration(''0s'') && duration(self.backendRequest) - > duration(self.request))' - type: object - x-kubernetes-validations: - - message: RequestRedirect filter must not be used together with - backendRefs - rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? - (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): - true' - - message: When using RequestRedirect filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - ? ((size(self.matches) != 1 || !has(self.matches[0].path) || - self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: When using URLRewrite filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - - message: Within backendRefs, when using RequestRedirect filter - with path.replacePrefixMatch, exactly one PathPrefix match must - be specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) - || self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: Within backendRefs, When using URLRewrite filter with - path.replacePrefixMatch, exactly one PathPrefix match must be - specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of HTTPRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.hostnames - name: Hostnames - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - HTTPRoute provides a way to route HTTP requests. This includes the capability - to match requests by hostname, path, header, or query param. Filters can be - used to specify additional processing steps. Backends specify where matching - requests should be routed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of HTTPRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames that should match against the HTTP Host - header to select a HTTPRoute used to process the request. Implementations - MUST ignore any port value specified in the HTTP Host header while - performing a match and (absent of any applicable header modification - configuration) MUST forward this header unmodified to the backend. - - - Valid values for Hostnames are determined by RFC 1123 definition of a - hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - If a hostname is specified by both the Listener and HTTPRoute, there - must be at least one intersecting hostname for the HTTPRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `*.example.com`, `test.example.com`, and `foo.test.example.com` would - all match. On the other hand, `example.com` and `test.example.net` would - not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and HTTPRoute have specified hostnames, any - HTTPRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - HTTPRoute specified `test.example.com` and `test.example.net`, - `test.example.net` must not be considered for a match. - - - If both the Listener and HTTPRoute have specified hostnames, and none - match with the criteria above, then the HTTPRoute is not accepted. The - implementation must raise an 'Accepted' Condition with a status of - `False` in the corresponding RouteParentStatus. - - - In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. - overlapping wildcard matching and exact matching hostnames), precedence must - be given to rules from the HTTPRoute with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - - - If ties exist across multiple Routes, the matching precedence rules for - HTTPRouteMatches takes over. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - default: - - matches: - - path: - type: PathPrefix - value: / - description: Rules are a list of HTTP matchers, filters and actions. - items: - description: |- - HTTPRouteRule defines semantics for matching an HTTP request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive a 500 status code. - - - See the HTTPBackendRef definition for the rules about what makes a single - HTTPBackendRef invalid. - - - When a HTTPBackendRef is invalid, 500 status codes MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive a 500 status code. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic must receive a 500. Implementations may - choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level should be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in HTTPRouteRule.) - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the - filter.type is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != - ''RequestRedirect'')' - - message: filter.requestRedirect must be specified - for RequestRedirect filter.type - rule: '!(!has(self.requestRedirect) && self.type == - ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() - <= 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - Wherever possible, implementations SHOULD implement filters in the order - they are specified. - - - Implementations MAY choose to implement this ordering strictly, rejecting - any combination or order of filters that can not be supported. If implementations - choose a strict interpretation of filter ordering, they MUST clearly document - that behavior. - - - To reject an invalid combination or order of filters, implementations SHOULD - consider the Route Rules with this configuration invalid. If all Route Rules - in a Route are invalid, the entire Route would be considered invalid. If only - a portion of Route Rules are invalid, implementations MUST set the - "PartiallyInvalid" condition for the Route. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - All filters are expected to be compatible with each other except for the - URLRewrite and RequestRedirect filters, which may not be combined. If an - implementation can not support other combinations of filters, they must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the filter.type - is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' - - message: filter.requestRedirect must be specified for RequestRedirect - filter.type - rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') && - self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() <= - 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 - matches: - default: - - path: - type: PathPrefix - value: / - description: |- - Matches define conditions used for matching the rule against incoming - HTTP requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - path: - value: "/foo" - headers: - - name: "version" - value: "v2" - - path: - value: "/v2/foo" - ``` - - - For a request to match against this rule, a request must satisfy - EITHER of the two conditions: - - - - path prefixed with `/foo` AND contains the header `version: v2` - - path prefix of `/v2/foo` - - - See the documentation for HTTPRouteMatch on how to specify multiple - match conditions that should be ANDed together. - - - If no matches are specified, the default is a prefix - path match on "/", which has the effect of matching every - HTTP request. - - - Proxy or Load Balancer routing configuration generated from HTTPRoutes - MUST prioritize matches based on the following criteria, continuing on - ties. Across all rules specified on applicable Routes, precedence must be - given to the match having: - - - * "Exact" path match. - * "Prefix" path match with largest number of characters. - * Method match. - * Largest number of header matches. - * Largest number of query param matches. - - - Note: The precedence of RegularExpression path matches are implementation-specific. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within an HTTPRoute, matching precedence MUST be granted - to the FIRST matching rule (in list order) with a match meeting the above - criteria. - - - When no rules matching a request have been successfully attached to the - parent a request is coming from, a HTTP 404 status code MUST be returned. - items: - description: "HTTPRouteMatch defines the predicate used to - match requests to a given\naction. Multiple match types - are ANDed together, i.e. the match will\nevaluate to true - only if all conditions are satisfied.\n\n\nFor example, - the match below will match a HTTP request only if its path\nstarts - with `/foo` AND it contains the `version: v1` header:\n\n\n```\nmatch:\n\n\n\tpath:\n\t - \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t - \ value \"v1\"\n\n\n```" - properties: - headers: - description: |- - Headers specifies HTTP request header matchers. Multiple match values are - ANDed together, meaning, a request must match all the specified headers - to select the route. - items: - description: |- - HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request - headers. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - - - When a header is repeated in an HTTP request, it is - implementation-specific behavior as to how this is represented. - Generally, proxies should follow the guidance from the RFC: - https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding - processing a repeated header, with special handling for "Set-Cookie". - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the header. - - - Support: Core (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression HeaderMatchType has implementation-specific - conformance, implementations can support POSIX, PCRE or any other dialects - of regular expressions. Please read the implementation's documentation to - determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP Header to - be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies HTTP method matcher. - When specified, this route will be matched only if the request has the - specified method. - - - Support: Extended - enum: - - GET - - HEAD - - POST - - PUT - - DELETE - - CONNECT - - OPTIONS - - TRACE - - PATCH - type: string - path: - default: - type: PathPrefix - value: / - description: |- - Path specifies a HTTP request path matcher. If this field is not - specified, a default prefix match on the "/" path is provided. - properties: - type: - default: PathPrefix - description: |- - Type specifies how to match against the path Value. - - - Support: Core (Exact, PathPrefix) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - PathPrefix - - RegularExpression - type: string - value: - default: / - description: Value of the HTTP path to match against. - maxLength: 1024 - type: string - type: object - x-kubernetes-validations: - - message: value must be an absolute path and start with - '/' when type one of ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') - : true' - - message: must not contain '//' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') - : true' - - message: must not contain '/./' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') - : true' - - message: must not contain '/../' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') - : true' - - message: must not contain '%2f' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') - : true' - - message: must not contain '%2F' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') - : true' - - message: must not contain '#' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') - : true' - - message: must not end with '/..' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') - : true' - - message: must not end with '/.' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') - : true' - - message: type must be one of ['Exact', 'PathPrefix', - 'RegularExpression'] - rule: self.type in ['Exact','PathPrefix'] || self.type - == 'RegularExpression' - - message: must only contain valid characters (matching - ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) - for types ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") - : true' - queryParams: - description: |- - QueryParams specifies HTTP query parameter matchers. Multiple match - values are ANDed together, meaning, a request must match all the - specified query parameters to select the route. - - - Support: Extended - items: - description: |- - HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP - query parameters. - properties: - name: - description: |- - Name is the name of the HTTP query param to be matched. This must be an - exact string match. (See - https://tools.ietf.org/html/rfc7230#section-2.7.3). - - - If multiple entries specify equivalent query param names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent query param name MUST be ignored. - - - If a query param is repeated in an HTTP request, the behavior is - purposely left undefined, since different data planes have different - capabilities. However, it is *recommended* that implementations should - match against the first value of the param if the data plane supports it, - as this behavior is expected in other load balancing contexts outside of - the Gateway API. - - - Users SHOULD NOT route traffic based on repeated query params to guard - themselves against potential differences in the implementations. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the query parameter. - - - Support: Extended (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression QueryParamMatchType has Implementation-specific - conformance, implementations can support POSIX, PCRE or any other - dialects of regular expressions. Please read the implementation's - documentation to determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP query param - to be matched. - maxLength: 1024 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - maxItems: 8 - type: array - sessionPersistence: - description: |+ - SessionPersistence defines and configures session persistence - for the route rule. - - - Support: Extended - - - properties: - absoluteTimeout: - description: |- - AbsoluteTimeout defines the absolute timeout of the persistent - session. Once the AbsoluteTimeout duration has elapsed, the - session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - cookieConfig: - description: |- - CookieConfig provides configuration settings that are specific - to cookie-based session persistence. - - - Support: Core - properties: - lifetimeType: - default: Session - description: |- - LifetimeType specifies whether the cookie has a permanent or - session-based lifetime. A permanent cookie persists until its - specified expiry time, defined by the Expires or Max-Age cookie - attributes, while a session cookie is deleted when the current - session ends. - - - When set to "Permanent", AbsoluteTimeout indicates the - cookie's lifetime via the Expires or Max-Age cookie attributes - and is required. - - - When set to "Session", AbsoluteTimeout indicates the - absolute lifetime of the cookie tracked by the gateway and - is optional. - - - Support: Core for "Session" type - - - Support: Extended for "Permanent" type - enum: - - Permanent - - Session - type: string - type: object - idleTimeout: - description: |- - IdleTimeout defines the idle timeout of the persistent session. - Once the session has been idle for more than the specified - IdleTimeout duration, the session becomes invalid. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - sessionName: - description: |- - SessionName defines the name of the persistent session token - which may be reflected in the cookie or the header. Users - should avoid reusing session names to prevent unintended - consequences, such as rejection or unpredictable behavior. - - - Support: Implementation-specific - maxLength: 128 - type: string - type: - default: Cookie - description: |- - Type defines the type of session persistence such as through - the use a header or cookie. Defaults to cookie based session - persistence. - - - Support: Core for "Cookie" type - - - Support: Extended for "Header" type - enum: - - Cookie - - Header - type: string - type: object - x-kubernetes-validations: - - message: AbsoluteTimeout must be specified when cookie lifetimeType - is Permanent - rule: '!has(self.cookieConfig.lifetimeType) || self.cookieConfig.lifetimeType - != ''Permanent'' || has(self.absoluteTimeout)' - timeouts: - description: |+ - Timeouts defines the timeouts that can be configured for an HTTP request. - - - Support: Extended - - - properties: - backendRequest: - description: |- - BackendRequest specifies a timeout for an individual request from the gateway - to a backend. This covers the time from when the request first starts being - sent from the gateway to when the full response has been received from the backend. - - - Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout - completely. Implementations that cannot completely disable the timeout MUST - instead interpret the zero duration as the longest possible value to which - the timeout can be set. - - - An entire client HTTP transaction with a gateway, covered by the Request timeout, - may result in more than one call from the gateway to the destination backend, - for example, if automatic retries are supported. - - - Because the Request timeout encompasses the BackendRequest timeout, the value of - BackendRequest must be <= the value of Request timeout. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - request: - description: |- - Request specifies the maximum duration for a gateway to respond to an HTTP request. - If the gateway has not been able to respond before this deadline is met, the gateway - MUST return a timeout error. - - - For example, setting the `rules.timeouts.request` field to the value `10s` in an - `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds - to complete. - - - Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout - completely. Implementations that cannot completely disable the timeout MUST - instead interpret the zero duration as the longest possible value to which - the timeout can be set. - - - This timeout is intended to cover as close to the whole request-response transaction - as possible although an implementation MAY choose to start the timeout after the entire - request stream has been received instead of immediately after the transaction is - initiated by the client. - - - When this field is unspecified, request timeout behavior is implementation-specific. - - - Support: Extended - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string - type: object - x-kubernetes-validations: - - message: backendRequest timeout cannot be longer than request - timeout - rule: '!(has(self.request) && has(self.backendRequest) && - duration(self.request) != duration(''0s'') && duration(self.backendRequest) - > duration(self.request))' - type: object - x-kubernetes-validations: - - message: RequestRedirect filter must not be used together with - backendRefs - rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? - (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): - true' - - message: When using RequestRedirect filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - ? ((size(self.matches) != 1 || !has(self.matches[0].path) || - self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: When using URLRewrite filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - - message: Within backendRefs, when using RequestRedirect filter - with path.replacePrefixMatch, exactly one PathPrefix match must - be specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) - || self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: Within backendRefs, When using URLRewrite filter with - path.replacePrefixMatch, exactly one PathPrefix match must be - specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of HTTPRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: referencegrants.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: ReferenceGrant - listKind: ReferenceGrantList - plural: referencegrants - shortNames: - - refgrant - singular: referencegrant - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - deprecated: true - deprecationWarning: The v1alpha2 version of ReferenceGrant has been deprecated - and will be removed in a future release of the API. Please upgrade to v1beta1. - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - ReferenceGrant identifies kinds of resources in other namespaces that are - trusted to reference the specified kinds of resources in the same namespace - as the policy. - - - Each ReferenceGrant can be used to represent a unique trust relationship. - Additional Reference Grants can be used to add to the set of trusted - sources of inbound references for the namespace they are defined within. - - - A ReferenceGrant is required for all cross-namespace references in Gateway API - (with the exception of cross-namespace Route-Gateway attachment, which is - governed by the AllowedRoutes configuration on the Gateway, and cross-namespace - Service ParentRefs on a "consumer" mesh Route, which defines routing rules - applicable only to workloads in the Route namespace). ReferenceGrants allowing - a reference from a Route to a Service are only applicable to BackendRefs. - - - ReferenceGrant is a form of runtime verification allowing users to assert - which cross-namespace object references are permitted. Implementations that - support ReferenceGrant MUST NOT permit cross-namespace references which have - no grant, and MUST respond to the removal of a grant by revoking the access - that the grant allowed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of ReferenceGrant. - properties: - from: - description: |- - From describes the trusted namespaces and kinds that can reference the - resources described in "To". Each entry in this list MUST be considered - to be an additional place that references can be valid from, or to put - this another way, entries MUST be combined using OR. - - - Support: Core - items: - description: ReferenceGrantFrom describes trusted namespaces and - kinds. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field. - - - When used to permit a SecretObjectReference: - - - * Gateway - - - When used to permit a BackendObjectReference: - - - * GRPCRoute - * HTTPRoute - * TCPRoute - * TLSRoute - * UDPRoute - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - namespace - type: object - maxItems: 16 - minItems: 1 - type: array - to: - description: |- - To describes the resources that may be referenced by the resources - described in "From". Each entry in this list MUST be considered to be an - additional place that references can be valid to, or to put this another - way, entries MUST be combined using OR. - - - Support: Core - items: - description: |- - ReferenceGrantTo describes what Kinds are allowed as targets of the - references. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field: - - - * Secret when used to permit a SecretObjectReference - * Service when used to permit a BackendObjectReference - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. When unspecified, this policy - refers to all resources of the specified Group and Kind in the local - namespace. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - from - - to - type: object - type: object - served: true - storage: false - subresources: {} - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - ReferenceGrant identifies kinds of resources in other namespaces that are - trusted to reference the specified kinds of resources in the same namespace - as the policy. - - - Each ReferenceGrant can be used to represent a unique trust relationship. - Additional Reference Grants can be used to add to the set of trusted - sources of inbound references for the namespace they are defined within. - - - All cross-namespace references in Gateway API (with the exception of cross-namespace - Gateway-route attachment) require a ReferenceGrant. - - - ReferenceGrant is a form of runtime verification allowing users to assert - which cross-namespace object references are permitted. Implementations that - support ReferenceGrant MUST NOT permit cross-namespace references which have - no grant, and MUST respond to the removal of a grant by revoking the access - that the grant allowed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of ReferenceGrant. - properties: - from: - description: |- - From describes the trusted namespaces and kinds that can reference the - resources described in "To". Each entry in this list MUST be considered - to be an additional place that references can be valid from, or to put - this another way, entries MUST be combined using OR. - - - Support: Core - items: - description: ReferenceGrantFrom describes trusted namespaces and - kinds. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field. - - - When used to permit a SecretObjectReference: - - - * Gateway - - - When used to permit a BackendObjectReference: - - - * GRPCRoute - * HTTPRoute - * TCPRoute - * TLSRoute - * UDPRoute - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - namespace - type: object - maxItems: 16 - minItems: 1 - type: array - to: - description: |- - To describes the resources that may be referenced by the resources - described in "From". Each entry in this list MUST be considered to be an - additional place that references can be valid to, or to put this another - way, entries MUST be combined using OR. - - - Support: Core - items: - description: |- - ReferenceGrantTo describes what Kinds are allowed as targets of the - references. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field: - - - * Secret when used to permit a SecretObjectReference - * Service when used to permit a BackendObjectReference - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. When unspecified, this policy - refers to all resources of the specified Group and Kind in the local - namespace. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - from - - to - type: object - type: object - served: true - storage: true - subresources: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: tcproutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: TCPRoute - listKind: TCPRouteList - plural: tcproutes - singular: tcproute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - TCPRoute provides a way to route TCP requests. When combined with a Gateway - listener, it can be used to forward connections on the port specified by the - listener to a set of backends specified by the TCPRoute. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of TCPRoute. - properties: - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - description: Rules are a list of TCP matchers and actions. - items: - description: TCPRouteRule is the configuration for a given rule. - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. If unspecified or invalid (refers to a non-existent resource or a - Service with no endpoints), the underlying implementation MUST actively - reject connection attempts to this backend. Connection rejections must - respect weight; if an invalid backend is requested to have 80% of - connections, then 80% of connections must be rejected instead. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Extended - items: - description: |- - BackendRef defines how a Route should forward a request to a Kubernetes - resource. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - - - Note that when the BackendTLSPolicy object is enabled by the implementation, - there are some extra rules about validity to consider here. See the fields - where this struct is used for more information about the exact behavior. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - minItems: 1 - type: array - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - rules - type: object - status: - description: Status defines the current state of TCPRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: tlsroutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: TLSRoute - listKind: TLSRouteList - plural: tlsroutes - singular: tlsroute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - The TLSRoute resource is similar to TCPRoute, but can be configured - to match against TLS-specific metadata. This allows more flexibility - in matching streams for a given TLS listener. - - - If you need to forward traffic to a single target for a TLS listener, you - could choose to use a TCPRoute with a TLS listener. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of TLSRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of SNI names that should match against the - SNI attribute of TLS ClientHello message in TLS handshake. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed in SNI names per RFC 6066. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - If a hostname is specified by both the Listener and TLSRoute, there - must be at least one intersecting hostname for the TLSRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches TLSRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches TLSRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `test.example.com` and `*.example.com` would both match. On the other - hand, `example.com` and `test.example.net` would not match. - - - If both the Listener and TLSRoute have specified hostnames, any - TLSRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - TLSRoute specified `test.example.com` and `test.example.net`, - `test.example.net` must not be considered for a match. - - - If both the Listener and TLSRoute have specified hostnames, and none - match with the criteria above, then the TLSRoute is not accepted. The - implementation must raise an 'Accepted' Condition with a status of - `False` in the corresponding RouteParentStatus. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - description: Rules are a list of TLS matchers and actions. - items: - description: TLSRouteRule is the configuration for a given rule. - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. If unspecified or invalid (refers to a non-existent resource or - a Service with no endpoints), the rule performs no forwarding; if no - filters are specified that would result in a response being sent, the - underlying implementation must actively reject request attempts to this - backend, by rejecting the connection or returning a 500 status code. - Request rejections must respect weight; if an invalid backend is - requested to have 80% of requests, then 80% of requests must be rejected - instead. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Extended - items: - description: |- - BackendRef defines how a Route should forward a request to a Kubernetes - resource. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - - - Note that when the BackendTLSPolicy object is enabled by the implementation, - there are some extra rules about validity to consider here. See the fields - where this struct is used for more information about the exact behavior. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - minItems: 1 - type: array - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - rules - type: object - status: - description: Status defines the current state of TLSRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: experimental - creationTimestamp: null - name: udproutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: UDPRoute - listKind: UDPRouteList - plural: udproutes - singular: udproute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - UDPRoute provides a way to route UDP traffic. When combined with a Gateway - listener, it can be used to forward traffic on the port specified by the - listener to a set of backends specified by the UDPRoute. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of UDPRoute. - properties: - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName or port must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) - || p2.port == 0)): true))' - - message: sectionName or port must be unique when parentRefs includes - 2 or more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) - || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port - == p2.port)))) - rules: - description: Rules are a list of UDP matchers and actions. - items: - description: UDPRouteRule is the configuration for a given rule. - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. If unspecified or invalid (refers to a non-existent resource or a - Service with no endpoints), the underlying implementation MUST actively - reject connection attempts to this backend. Packet drops must - respect weight; if an invalid backend is requested to have 80% of - the packets, then 80% of packets must be dropped instead. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Extended - items: - description: |- - BackendRef defines how a Route should forward a request to a Kubernetes - resource. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - - - Note that when the BackendTLSPolicy object is enabled by the implementation, - there are some extra rules about validity to consider here. See the fields - where this struct is used for more information about the exact behavior. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - minItems: 1 - type: array - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - rules - type: object - status: - description: Status defines the current state of UDPRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null diff --git a/kubespray/project/roles/kubernetes-apps/gateway_api/templates/standard-install.yaml.j2 b/kubespray/project/roles/kubernetes-apps/gateway_api/templates/standard-install.yaml.j2 deleted file mode 100644 index fcb65e6..0000000 --- a/kubespray/project/roles/kubernetes-apps/gateway_api/templates/standard-install.yaml.j2 +++ /dev/null @@ -1,13478 +0,0 @@ -# Copyright 2024 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# -# Gateway API Standard channel install -# ---- -# -# config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: standard - creationTimestamp: null - name: gatewayclasses.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: GatewayClass - listKind: GatewayClassList - plural: gatewayclasses - shortNames: - - gc - singular: gatewayclass - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .spec.controllerName - name: Controller - type: string - - jsonPath: .status.conditions[?(@.type=="Accepted")].status - name: Accepted - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .spec.description - name: Description - priority: 1 - type: string - name: v1 - schema: - openAPIV3Schema: - description: |- - GatewayClass describes a class of Gateways available to the user for creating - Gateway resources. - - - It is recommended that this resource be used as a template for Gateways. This - means that a Gateway is based on the state of the GatewayClass at the time it - was created and changes to the GatewayClass or associated parameters are not - propagated down to existing Gateways. This recommendation is intended to - limit the blast radius of changes to GatewayClass or associated parameters. - If implementations choose to propagate GatewayClass changes to existing - Gateways, that MUST be clearly documented by the implementation. - - - Whenever one or more Gateways are using a GatewayClass, implementations SHOULD - add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the - associated GatewayClass. This ensures that a GatewayClass associated with a - Gateway is not deleted while in use. - - - GatewayClass is a Cluster level resource. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GatewayClass. - properties: - controllerName: - description: |- - ControllerName is the name of the controller that is managing Gateways of - this class. The value of this field MUST be a domain prefixed path. - - - Example: "example.net/gateway-controller". - - - This field is not mutable and cannot be empty. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - description: - description: Description helps describe a GatewayClass with more details. - maxLength: 64 - type: string - parametersRef: - description: |- - ParametersRef is a reference to a resource that contains the configuration - parameters corresponding to the GatewayClass. This is optional if the - controller does not require any additional configuration. - - - ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, - or an implementation-specific custom resource. The resource can be - cluster-scoped or namespace-scoped. - - - If the referent cannot be found, the GatewayClass's "InvalidParameters" - status condition will be true. - - - A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, - the merging behavior is implementation specific. - It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. - - - Support: Implementation-specific - properties: - group: - description: Group is the group of the referent. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - This field is required when referring to a Namespace-scoped resource and - MUST be unset when referring to a Cluster-scoped resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - name - type: object - required: - - controllerName - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Waiting - status: Unknown - type: Accepted - description: |- - Status defines the current state of GatewayClass. - - - Implementations MUST populate status on all GatewayClass resources which - specify their controller name. - properties: - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - description: |- - Conditions is the current status from the controller for - this GatewayClass. - - - Controllers should prefer to publish conditions using values - of GatewayClassConditionType for the type of each Condition. - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.controllerName - name: Controller - type: string - - jsonPath: .status.conditions[?(@.type=="Accepted")].status - name: Accepted - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .spec.description - name: Description - priority: 1 - type: string - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - GatewayClass describes a class of Gateways available to the user for creating - Gateway resources. - - - It is recommended that this resource be used as a template for Gateways. This - means that a Gateway is based on the state of the GatewayClass at the time it - was created and changes to the GatewayClass or associated parameters are not - propagated down to existing Gateways. This recommendation is intended to - limit the blast radius of changes to GatewayClass or associated parameters. - If implementations choose to propagate GatewayClass changes to existing - Gateways, that MUST be clearly documented by the implementation. - - - Whenever one or more Gateways are using a GatewayClass, implementations SHOULD - add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the - associated GatewayClass. This ensures that a GatewayClass associated with a - Gateway is not deleted while in use. - - - GatewayClass is a Cluster level resource. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GatewayClass. - properties: - controllerName: - description: |- - ControllerName is the name of the controller that is managing Gateways of - this class. The value of this field MUST be a domain prefixed path. - - - Example: "example.net/gateway-controller". - - - This field is not mutable and cannot be empty. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - x-kubernetes-validations: - - message: Value is immutable - rule: self == oldSelf - description: - description: Description helps describe a GatewayClass with more details. - maxLength: 64 - type: string - parametersRef: - description: |- - ParametersRef is a reference to a resource that contains the configuration - parameters corresponding to the GatewayClass. This is optional if the - controller does not require any additional configuration. - - - ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, - or an implementation-specific custom resource. The resource can be - cluster-scoped or namespace-scoped. - - - If the referent cannot be found, the GatewayClass's "InvalidParameters" - status condition will be true. - - - A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, - the merging behavior is implementation specific. - It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. - - - Support: Implementation-specific - properties: - group: - description: Group is the group of the referent. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - This field is required when referring to a Namespace-scoped resource and - MUST be unset when referring to a Cluster-scoped resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - name - type: object - required: - - controllerName - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Waiting - status: Unknown - type: Accepted - description: |- - Status defines the current state of GatewayClass. - - - Implementations MUST populate status on all GatewayClass resources which - specify their controller name. - properties: - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - description: |- - Conditions is the current status from the controller for - this GatewayClass. - - - Controllers should prefer to publish conditions using values - of GatewayClassConditionType for the type of each Condition. - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/standard/gateway.networking.k8s.io_gateways.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: standard - creationTimestamp: null - name: gateways.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: Gateway - listKind: GatewayList - plural: gateways - shortNames: - - gtw - singular: gateway - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.gatewayClassName - name: Class - type: string - - jsonPath: .status.addresses[*].value - name: Address - type: string - - jsonPath: .status.conditions[?(@.type=="Programmed")].status - name: Programmed - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - Gateway represents an instance of a service-traffic handling infrastructure - by binding Listeners to a set of IP addresses. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of Gateway. - properties: - addresses: - description: |+ - Addresses requested for this Gateway. This is optional and behavior can - depend on the implementation. If a value is set in the spec and the - requested address is invalid or unavailable, the implementation MUST - indicate this in the associated entry in GatewayStatus.Addresses. - - - The Addresses field represents a request for the address(es) on the - "outside of the Gateway", that traffic bound for this Gateway will use. - This could be the IP address or hostname of an external load balancer or - other networking infrastructure, or some other address that traffic will - be sent to. - - - If no Addresses are specified, the implementation MAY schedule the - Gateway in an implementation-specific manner, assigning an appropriate - set of Addresses. - - - The implementation MUST bind all Listeners to every GatewayAddress that - it assigns to the Gateway and add a corresponding entry in - GatewayStatus.Addresses. - - - Support: Extended - - - items: - description: GatewayAddress describes an address that can be bound - to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: IPAddress values must be unique - rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - - message: Hostname values must be unique - rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - gatewayClassName: - description: |- - GatewayClassName used for this Gateway. This is the name of a - GatewayClass resource. - maxLength: 253 - minLength: 1 - type: string - listeners: - description: |- - Listeners associated with this Gateway. Listeners define - logical endpoints that are bound on this Gateway's addresses. - At least one Listener MUST be specified. - - - Each Listener in a set of Listeners (for example, in a single Gateway) - MUST be _distinct_, in that a traffic flow MUST be able to be assigned to - exactly one listener. (This section uses "set of Listeners" rather than - "Listeners in a single Gateway" because implementations MAY merge configuration - from multiple Gateways onto a single data plane, and these rules _also_ - apply in that case). - - - Practically, this means that each listener in a set MUST have a unique - combination of Port, Protocol, and, if supported by the protocol, Hostname. - - - Some combinations of port, protocol, and TLS settings are considered - Core support and MUST be supported by implementations based on their - targeted conformance profile: - - - HTTP Profile - - - 1. HTTPRoute, Port: 80, Protocol: HTTP - 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided - - - TLS Profile - - - 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough - - - "Distinct" Listeners have the following property: - - - The implementation can match inbound requests to a single distinct - Listener. When multiple Listeners share values for fields (for - example, two Listeners with the same Port value), the implementation - can match requests to only one of the Listeners using other - Listener fields. - - - For example, the following Listener scenarios are distinct: - - - 1. Multiple Listeners with the same Port that all use the "HTTP" - Protocol that all have unique Hostname values. - 2. Multiple Listeners with the same Port that use either the "HTTPS" or - "TLS" Protocol that all have unique Hostname values. - 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener - with the same Protocol has the same Port value. - - - Some fields in the Listener struct have possible values that affect - whether the Listener is distinct. Hostname is particularly relevant - for HTTP or HTTPS protocols. - - - When using the Hostname value to select between same-Port, same-Protocol - Listeners, the Hostname value must be different on each Listener for the - Listener to be distinct. - - - When the Listeners are distinct based on Hostname, inbound request - hostnames MUST match from the most specific to least specific Hostname - values to choose the correct Listener and its associated set of Routes. - - - Exact matches must be processed before wildcard matches, and wildcard - matches must be processed before fallback (empty Hostname value) - matches. For example, `"foo.example.com"` takes precedence over - `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. - - - Additionally, if there are multiple wildcard entries, more specific - wildcard entries must be processed before less specific wildcard entries. - For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. - The precise definition here is that the higher the number of dots in the - hostname to the right of the wildcard character, the higher the precedence. - - - The wildcard character will match any number of characters _and dots_ to - the left, however, so `"*.example.com"` will match both - `"foo.bar.example.com"` _and_ `"bar.example.com"`. - - - If a set of Listeners contains Listeners that are not distinct, then those - Listeners are Conflicted, and the implementation MUST set the "Conflicted" - condition in the Listener Status to "True". - - - Implementations MAY choose to accept a Gateway with some Conflicted - Listeners only if they only accept the partial Listener set that contains - no Conflicted Listeners. To put this another way, implementations may - accept a partial Listener set only if they throw out *all* the conflicting - Listeners. No picking one of the conflicting listeners as the winner. - This also means that the Gateway must have at least one non-conflicting - Listener in this case, otherwise it violates the requirement that at - least one Listener must be present. - - - The implementation MUST set a "ListenersNotValid" condition on the - Gateway Status when the Gateway contains Conflicted Listeners whether or - not they accept the Gateway. That Condition SHOULD clearly - indicate in the Message which Listeners are conflicted, and which are - Accepted. Additionally, the Listener status for those listeners SHOULD - indicate which Listeners are conflicted and not Accepted. - - - A Gateway's Listeners are considered "compatible" if: - - - 1. They are distinct. - 2. The implementation can serve them in compliance with the Addresses - requirement that all Listeners are available on all assigned - addresses. - - - Compatible combinations in Extended support are expected to vary across - implementations. A combination that is compatible for one implementation - may not be compatible for another. - - - For example, an implementation that cannot serve both TCP and UDP listeners - on the same address, or cannot mix HTTPS and generic TLS listens on the same port - would not consider those cases compatible, even though they are distinct. - - - Note that requests SHOULD match at most one Listener. For example, if - Listeners are defined for "foo.example.com" and "*.example.com", a - request to "foo.example.com" SHOULD only be routed using routes attached - to the "foo.example.com" Listener (and not the "*.example.com" Listener). - This concept is known as "Listener Isolation". Implementations that do - not support Listener Isolation MUST clearly document this. - - - Implementations MAY merge separate Gateways onto a single set of - Addresses if all Listeners across all Gateways are compatible. - - - Support: Core - items: - description: |- - Listener embodies the concept of a logical endpoint where a Gateway accepts - network connections. - properties: - allowedRoutes: - default: - namespaces: - from: Same - description: |- - AllowedRoutes defines the types of routes that MAY be attached to a - Listener and the trusted namespaces where those Route resources MAY be - present. - - - Although a client request may match multiple route rules, only one rule - may ultimately receive the request. Matching precedence MUST be - determined in order of the following criteria: - - - * The most specific match as defined by the Route type. - * The oldest Route based on creation timestamp. For example, a Route with - a creation timestamp of "2020-09-08 01:02:03" is given precedence over - a Route with a creation timestamp of "2020-09-08 01:02:04". - * If everything else is equivalent, the Route appearing first in - alphabetical order (namespace/name) should be given precedence. For - example, foo/bar is given precedence over foo/baz. - - - All valid rules within a Route attached to this Listener should be - implemented. Invalid Route rules can be ignored (sometimes that will mean - the full Route). If a Route rule transitions from valid to invalid, - support for that Route rule should be dropped to ensure consistency. For - example, even if a filter specified by a Route rule is invalid, the rest - of the rules within that Route should still be supported. - - - Support: Core - properties: - kinds: - description: |- - Kinds specifies the groups and kinds of Routes that are allowed to bind - to this Gateway Listener. When unspecified or empty, the kinds of Routes - selected are determined using the Listener protocol. - - - A RouteGroupKind MUST correspond to kinds of Routes that are compatible - with the application protocol specified in the Listener's Protocol field. - If an implementation does not support or recognize this resource type, it - MUST set the "ResolvedRefs" condition to False for this Listener with the - "InvalidRouteKinds" reason. - - - Support: Core - items: - description: RouteGroupKind indicates the group and kind - of a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - namespaces: - default: - from: Same - description: |- - Namespaces indicates namespaces from which Routes may be attached to this - Listener. This is restricted to the namespace of this Gateway by default. - - - Support: Core - properties: - from: - default: Same - description: |- - From indicates where Routes will be selected for this Gateway. Possible - values are: - - - * All: Routes in all namespaces may be used by this Gateway. - * Selector: Routes in namespaces selected by the selector may be used by - this Gateway. - * Same: Only Routes in the same namespace may be used by this Gateway. - - - Support: Core - enum: - - All - - Selector - - Same - type: string - selector: - description: |- - Selector must be specified when From is set to "Selector". In that case, - only Routes in Namespaces matching this Selector will be selected by this - Gateway. This field is ignored for other values of "From". - - - Support: Core - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: object - hostname: - description: |- - Hostname specifies the virtual hostname to match for protocol types that - define this concept. When unspecified, all hostnames are matched. This - field is ignored for protocols that don't require hostname based - matching. - - - Implementations MUST apply Hostname matching appropriately for each of - the following protocols: - - - * TLS: The Listener Hostname MUST match the SNI. - * HTTP: The Listener Hostname MUST match the Host header of the request. - * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP - protocol layers as described above. If an implementation does not - ensure that both the SNI and Host header match the Listener hostname, - it MUST clearly document that. - - - For HTTPRoute and TLSRoute resources, there is an interaction with the - `spec.hostnames` array. When both listener and route specify hostnames, - there MUST be an intersection between the values for a Route to be - accepted. For more information, refer to the Route specific Hostnames - documentation. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - name: - description: |- - Name is the name of the Listener. This name MUST be unique within a - Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - port: - description: |- - Port is the network port. Multiple listeners may use the - same port, subject to the Listener compatibility rules. - - - Support: Core - format: int32 - maximum: 65535 - minimum: 1 - type: integer - protocol: - description: |- - Protocol specifies the network protocol this listener expects to receive. - - - Support: Core - maxLength: 255 - minLength: 1 - pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ - type: string - tls: - description: |- - TLS is the TLS configuration for the Listener. This field is required if - the Protocol field is "HTTPS" or "TLS". It is invalid to set this field - if the Protocol field is "HTTP", "TCP", or "UDP". - - - The association of SNIs to Certificate defined in GatewayTLSConfig is - defined based on the Hostname field for this listener. - - - The GatewayClass MUST use the longest matching SNI out of all - available certificates for any TLS handshake. - - - Support: Core - properties: - certificateRefs: - description: |- - CertificateRefs contains a series of references to Kubernetes objects that - contains TLS certificates and private keys. These certificates are used to - establish a TLS handshake for requests that match the hostname of the - associated listener. - - - A single CertificateRef to a Kubernetes Secret has "Core" support. - Implementations MAY choose to support attaching multiple certificates to - a Listener, but this behavior is implementation-specific. - - - References to a resource in different namespace are invalid UNLESS there - is a ReferenceGrant in the target namespace that allows the certificate - to be attached. If a ReferenceGrant does not allow this reference, the - "ResolvedRefs" condition MUST be set to False for this listener with the - "RefNotPermitted" reason. - - - This field is required to have at least one element when the mode is set - to "Terminate" (default) and is optional otherwise. - - - CertificateRefs can reference to standard Kubernetes resources, i.e. - Secret, or implementation-specific custom resources. - - - Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls - - - Support: Implementation-specific (More than one reference or other resource types) - items: - description: |- - SecretObjectReference identifies an API object including its namespace, - defaulting to Secret. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Secret - description: Kind is kind of the referent. For example - "Secret". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referenced object. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - name - type: object - maxItems: 64 - type: array - mode: - default: Terminate - description: |- - Mode defines the TLS behavior for the TLS session initiated by the client. - There are two possible modes: - - - - Terminate: The TLS session between the downstream client and the - Gateway is terminated at the Gateway. This mode requires certificates - to be specified in some way, such as populating the certificateRefs - field. - - Passthrough: The TLS session is NOT terminated by the Gateway. This - implies that the Gateway can't decipher the TLS stream except for - the ClientHello message of the TLS protocol. The certificateRefs field - is ignored in this mode. - - - Support: Core - enum: - - Terminate - - Passthrough - type: string - options: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Options are a list of key/value pairs to enable extended TLS - configuration for each implementation. For example, configuring the - minimum TLS version or supported cipher suites. - - - A set of common keys MAY be defined by the API in the future. To avoid - any ambiguity, implementation-specific definitions MUST use - domain-prefixed names, such as `example.com/my-custom-option`. - Un-prefixed names are reserved for key names defined by Gateway API. - - - Support: Implementation-specific - maxProperties: 16 - type: object - type: object - x-kubernetes-validations: - - message: certificateRefs or options must be specified when - mode is Terminate - rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) - > 0 || size(self.options) > 0 : true' - required: - - name - - port - - protocol - type: object - maxItems: 64 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: tls must not be specified for protocols ['HTTP', 'TCP', - 'UDP'] - rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? - !has(l.tls) : true)' - - message: tls mode must be Terminate for protocol HTTPS - rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode - == '''' || l.tls.mode == ''Terminate'') : true)' - - message: hostname must not be specified for protocols ['TCP', 'UDP'] - rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) - || l.hostname == '''') : true)' - - message: Listener name must be unique within the Gateway - rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) - - message: Combination of port, protocol and hostname must be unique - for each listener - rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol - == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname - == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' - required: - - gatewayClassName - - listeners - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: Status defines the current state of Gateway. - properties: - addresses: - description: |+ - Addresses lists the network addresses that have been bound to the - Gateway. - - - This list may differ from the addresses provided in the spec under some - conditions: - - - * no addresses are specified, all addresses are dynamically assigned - * a combination of specified and dynamic addresses are assigned - * a specified address was unusable (e.g. already in use) - - - items: - description: GatewayStatusAddress describes a network address that - is bound to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: |- - Conditions describe the current conditions of the Gateway. - - - Implementations should prefer to express Gateway conditions - using the `GatewayConditionType` and `GatewayConditionReason` - constants so that operators and tools can converge on a common - vocabulary to describe Gateway state. - - - Known condition types are: - - - * "Accepted" - * "Programmed" - * "Ready" - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - listeners: - description: Listeners provide status for each unique listener port - defined in the Spec. - items: - description: ListenerStatus is the status associated with a Listener. - properties: - attachedRoutes: - description: |- - AttachedRoutes represents the total number of Routes that have been - successfully attached to this Listener. - - - Successful attachment of a Route to a Listener is based solely on the - combination of the AllowedRoutes field on the corresponding Listener - and the Route's ParentRefs field. A Route is successfully attached to - a Listener when it is selected by the Listener's AllowedRoutes field - AND the Route has a valid ParentRef selecting the whole Gateway - resource or a specific Listener as a parent resource (more detail on - attachment semantics can be found in the documentation on the various - Route kinds ParentRefs fields). Listener or Route status does not impact - successful attachment, i.e. the AttachedRoutes field count MUST be set - for Listeners with condition Accepted: false and MUST count successfully - attached Routes that may themselves have Accepted: false conditions. - - - Uses for this field include troubleshooting Route attachment and - measuring blast radius/impact of changes to a Listener. - format: int32 - type: integer - conditions: - description: Conditions describe the current condition of this - listener. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - name: - description: Name is the name of the Listener that this status - corresponds to. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - supportedKinds: - description: |- - SupportedKinds is the list indicating the Kinds supported by this - listener. This MUST represent the kinds an implementation supports for - that Listener configuration. - - - If kinds are specified in Spec that are not supported, they MUST NOT - appear in this list and an implementation MUST set the "ResolvedRefs" - condition to "False" with the "InvalidRouteKinds" reason. If both valid - and invalid Route kinds are specified, the implementation MUST - reference the valid Route kinds that have been specified. - items: - description: RouteGroupKind indicates the group and kind of - a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - required: - - attachedRoutes - - conditions - - name - - supportedKinds - type: object - maxItems: 64 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.gatewayClassName - name: Class - type: string - - jsonPath: .status.addresses[*].value - name: Address - type: string - - jsonPath: .status.conditions[?(@.type=="Programmed")].status - name: Programmed - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - Gateway represents an instance of a service-traffic handling infrastructure - by binding Listeners to a set of IP addresses. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of Gateway. - properties: - addresses: - description: |+ - Addresses requested for this Gateway. This is optional and behavior can - depend on the implementation. If a value is set in the spec and the - requested address is invalid or unavailable, the implementation MUST - indicate this in the associated entry in GatewayStatus.Addresses. - - - The Addresses field represents a request for the address(es) on the - "outside of the Gateway", that traffic bound for this Gateway will use. - This could be the IP address or hostname of an external load balancer or - other networking infrastructure, or some other address that traffic will - be sent to. - - - If no Addresses are specified, the implementation MAY schedule the - Gateway in an implementation-specific manner, assigning an appropriate - set of Addresses. - - - The implementation MUST bind all Listeners to every GatewayAddress that - it assigns to the Gateway and add a corresponding entry in - GatewayStatus.Addresses. - - - Support: Extended - - - items: - description: GatewayAddress describes an address that can be bound - to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: IPAddress values must be unique - rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - - message: Hostname values must be unique - rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, - a2.type == a1.type && a2.value == a1.value) : true )' - gatewayClassName: - description: |- - GatewayClassName used for this Gateway. This is the name of a - GatewayClass resource. - maxLength: 253 - minLength: 1 - type: string - listeners: - description: |- - Listeners associated with this Gateway. Listeners define - logical endpoints that are bound on this Gateway's addresses. - At least one Listener MUST be specified. - - - Each Listener in a set of Listeners (for example, in a single Gateway) - MUST be _distinct_, in that a traffic flow MUST be able to be assigned to - exactly one listener. (This section uses "set of Listeners" rather than - "Listeners in a single Gateway" because implementations MAY merge configuration - from multiple Gateways onto a single data plane, and these rules _also_ - apply in that case). - - - Practically, this means that each listener in a set MUST have a unique - combination of Port, Protocol, and, if supported by the protocol, Hostname. - - - Some combinations of port, protocol, and TLS settings are considered - Core support and MUST be supported by implementations based on their - targeted conformance profile: - - - HTTP Profile - - - 1. HTTPRoute, Port: 80, Protocol: HTTP - 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided - - - TLS Profile - - - 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough - - - "Distinct" Listeners have the following property: - - - The implementation can match inbound requests to a single distinct - Listener. When multiple Listeners share values for fields (for - example, two Listeners with the same Port value), the implementation - can match requests to only one of the Listeners using other - Listener fields. - - - For example, the following Listener scenarios are distinct: - - - 1. Multiple Listeners with the same Port that all use the "HTTP" - Protocol that all have unique Hostname values. - 2. Multiple Listeners with the same Port that use either the "HTTPS" or - "TLS" Protocol that all have unique Hostname values. - 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener - with the same Protocol has the same Port value. - - - Some fields in the Listener struct have possible values that affect - whether the Listener is distinct. Hostname is particularly relevant - for HTTP or HTTPS protocols. - - - When using the Hostname value to select between same-Port, same-Protocol - Listeners, the Hostname value must be different on each Listener for the - Listener to be distinct. - - - When the Listeners are distinct based on Hostname, inbound request - hostnames MUST match from the most specific to least specific Hostname - values to choose the correct Listener and its associated set of Routes. - - - Exact matches must be processed before wildcard matches, and wildcard - matches must be processed before fallback (empty Hostname value) - matches. For example, `"foo.example.com"` takes precedence over - `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. - - - Additionally, if there are multiple wildcard entries, more specific - wildcard entries must be processed before less specific wildcard entries. - For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. - The precise definition here is that the higher the number of dots in the - hostname to the right of the wildcard character, the higher the precedence. - - - The wildcard character will match any number of characters _and dots_ to - the left, however, so `"*.example.com"` will match both - `"foo.bar.example.com"` _and_ `"bar.example.com"`. - - - If a set of Listeners contains Listeners that are not distinct, then those - Listeners are Conflicted, and the implementation MUST set the "Conflicted" - condition in the Listener Status to "True". - - - Implementations MAY choose to accept a Gateway with some Conflicted - Listeners only if they only accept the partial Listener set that contains - no Conflicted Listeners. To put this another way, implementations may - accept a partial Listener set only if they throw out *all* the conflicting - Listeners. No picking one of the conflicting listeners as the winner. - This also means that the Gateway must have at least one non-conflicting - Listener in this case, otherwise it violates the requirement that at - least one Listener must be present. - - - The implementation MUST set a "ListenersNotValid" condition on the - Gateway Status when the Gateway contains Conflicted Listeners whether or - not they accept the Gateway. That Condition SHOULD clearly - indicate in the Message which Listeners are conflicted, and which are - Accepted. Additionally, the Listener status for those listeners SHOULD - indicate which Listeners are conflicted and not Accepted. - - - A Gateway's Listeners are considered "compatible" if: - - - 1. They are distinct. - 2. The implementation can serve them in compliance with the Addresses - requirement that all Listeners are available on all assigned - addresses. - - - Compatible combinations in Extended support are expected to vary across - implementations. A combination that is compatible for one implementation - may not be compatible for another. - - - For example, an implementation that cannot serve both TCP and UDP listeners - on the same address, or cannot mix HTTPS and generic TLS listens on the same port - would not consider those cases compatible, even though they are distinct. - - - Note that requests SHOULD match at most one Listener. For example, if - Listeners are defined for "foo.example.com" and "*.example.com", a - request to "foo.example.com" SHOULD only be routed using routes attached - to the "foo.example.com" Listener (and not the "*.example.com" Listener). - This concept is known as "Listener Isolation". Implementations that do - not support Listener Isolation MUST clearly document this. - - - Implementations MAY merge separate Gateways onto a single set of - Addresses if all Listeners across all Gateways are compatible. - - - Support: Core - items: - description: |- - Listener embodies the concept of a logical endpoint where a Gateway accepts - network connections. - properties: - allowedRoutes: - default: - namespaces: - from: Same - description: |- - AllowedRoutes defines the types of routes that MAY be attached to a - Listener and the trusted namespaces where those Route resources MAY be - present. - - - Although a client request may match multiple route rules, only one rule - may ultimately receive the request. Matching precedence MUST be - determined in order of the following criteria: - - - * The most specific match as defined by the Route type. - * The oldest Route based on creation timestamp. For example, a Route with - a creation timestamp of "2020-09-08 01:02:03" is given precedence over - a Route with a creation timestamp of "2020-09-08 01:02:04". - * If everything else is equivalent, the Route appearing first in - alphabetical order (namespace/name) should be given precedence. For - example, foo/bar is given precedence over foo/baz. - - - All valid rules within a Route attached to this Listener should be - implemented. Invalid Route rules can be ignored (sometimes that will mean - the full Route). If a Route rule transitions from valid to invalid, - support for that Route rule should be dropped to ensure consistency. For - example, even if a filter specified by a Route rule is invalid, the rest - of the rules within that Route should still be supported. - - - Support: Core - properties: - kinds: - description: |- - Kinds specifies the groups and kinds of Routes that are allowed to bind - to this Gateway Listener. When unspecified or empty, the kinds of Routes - selected are determined using the Listener protocol. - - - A RouteGroupKind MUST correspond to kinds of Routes that are compatible - with the application protocol specified in the Listener's Protocol field. - If an implementation does not support or recognize this resource type, it - MUST set the "ResolvedRefs" condition to False for this Listener with the - "InvalidRouteKinds" reason. - - - Support: Core - items: - description: RouteGroupKind indicates the group and kind - of a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - namespaces: - default: - from: Same - description: |- - Namespaces indicates namespaces from which Routes may be attached to this - Listener. This is restricted to the namespace of this Gateway by default. - - - Support: Core - properties: - from: - default: Same - description: |- - From indicates where Routes will be selected for this Gateway. Possible - values are: - - - * All: Routes in all namespaces may be used by this Gateway. - * Selector: Routes in namespaces selected by the selector may be used by - this Gateway. - * Same: Only Routes in the same namespace may be used by this Gateway. - - - Support: Core - enum: - - All - - Selector - - Same - type: string - selector: - description: |- - Selector must be specified when From is set to "Selector". In that case, - only Routes in Namespaces matching this Selector will be selected by this - Gateway. This field is ignored for other values of "From". - - - Support: Core - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: object - hostname: - description: |- - Hostname specifies the virtual hostname to match for protocol types that - define this concept. When unspecified, all hostnames are matched. This - field is ignored for protocols that don't require hostname based - matching. - - - Implementations MUST apply Hostname matching appropriately for each of - the following protocols: - - - * TLS: The Listener Hostname MUST match the SNI. - * HTTP: The Listener Hostname MUST match the Host header of the request. - * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP - protocol layers as described above. If an implementation does not - ensure that both the SNI and Host header match the Listener hostname, - it MUST clearly document that. - - - For HTTPRoute and TLSRoute resources, there is an interaction with the - `spec.hostnames` array. When both listener and route specify hostnames, - there MUST be an intersection between the values for a Route to be - accepted. For more information, refer to the Route specific Hostnames - documentation. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - name: - description: |- - Name is the name of the Listener. This name MUST be unique within a - Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - port: - description: |- - Port is the network port. Multiple listeners may use the - same port, subject to the Listener compatibility rules. - - - Support: Core - format: int32 - maximum: 65535 - minimum: 1 - type: integer - protocol: - description: |- - Protocol specifies the network protocol this listener expects to receive. - - - Support: Core - maxLength: 255 - minLength: 1 - pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ - type: string - tls: - description: |- - TLS is the TLS configuration for the Listener. This field is required if - the Protocol field is "HTTPS" or "TLS". It is invalid to set this field - if the Protocol field is "HTTP", "TCP", or "UDP". - - - The association of SNIs to Certificate defined in GatewayTLSConfig is - defined based on the Hostname field for this listener. - - - The GatewayClass MUST use the longest matching SNI out of all - available certificates for any TLS handshake. - - - Support: Core - properties: - certificateRefs: - description: |- - CertificateRefs contains a series of references to Kubernetes objects that - contains TLS certificates and private keys. These certificates are used to - establish a TLS handshake for requests that match the hostname of the - associated listener. - - - A single CertificateRef to a Kubernetes Secret has "Core" support. - Implementations MAY choose to support attaching multiple certificates to - a Listener, but this behavior is implementation-specific. - - - References to a resource in different namespace are invalid UNLESS there - is a ReferenceGrant in the target namespace that allows the certificate - to be attached. If a ReferenceGrant does not allow this reference, the - "ResolvedRefs" condition MUST be set to False for this listener with the - "RefNotPermitted" reason. - - - This field is required to have at least one element when the mode is set - to "Terminate" (default) and is optional otherwise. - - - CertificateRefs can reference to standard Kubernetes resources, i.e. - Secret, or implementation-specific custom resources. - - - Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls - - - Support: Implementation-specific (More than one reference or other resource types) - items: - description: |- - SecretObjectReference identifies an API object including its namespace, - defaulting to Secret. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - - - References to objects with invalid Group and Kind are not valid, and must - be rejected by the implementation, with appropriate Conditions set - on the containing object. - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Secret - description: Kind is kind of the referent. For example - "Secret". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referenced object. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - name - type: object - maxItems: 64 - type: array - mode: - default: Terminate - description: |- - Mode defines the TLS behavior for the TLS session initiated by the client. - There are two possible modes: - - - - Terminate: The TLS session between the downstream client and the - Gateway is terminated at the Gateway. This mode requires certificates - to be specified in some way, such as populating the certificateRefs - field. - - Passthrough: The TLS session is NOT terminated by the Gateway. This - implies that the Gateway can't decipher the TLS stream except for - the ClientHello message of the TLS protocol. The certificateRefs field - is ignored in this mode. - - - Support: Core - enum: - - Terminate - - Passthrough - type: string - options: - additionalProperties: - description: |- - AnnotationValue is the value of an annotation in Gateway API. This is used - for validation of maps such as TLS options. This roughly matches Kubernetes - annotation validation, although the length validation in that case is based - on the entire size of the annotations struct. - maxLength: 4096 - minLength: 0 - type: string - description: |- - Options are a list of key/value pairs to enable extended TLS - configuration for each implementation. For example, configuring the - minimum TLS version or supported cipher suites. - - - A set of common keys MAY be defined by the API in the future. To avoid - any ambiguity, implementation-specific definitions MUST use - domain-prefixed names, such as `example.com/my-custom-option`. - Un-prefixed names are reserved for key names defined by Gateway API. - - - Support: Implementation-specific - maxProperties: 16 - type: object - type: object - x-kubernetes-validations: - - message: certificateRefs or options must be specified when - mode is Terminate - rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) - > 0 || size(self.options) > 0 : true' - required: - - name - - port - - protocol - type: object - maxItems: 64 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: tls must not be specified for protocols ['HTTP', 'TCP', - 'UDP'] - rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? - !has(l.tls) : true)' - - message: tls mode must be Terminate for protocol HTTPS - rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode - == '''' || l.tls.mode == ''Terminate'') : true)' - - message: hostname must not be specified for protocols ['TCP', 'UDP'] - rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) - || l.hostname == '''') : true)' - - message: Listener name must be unique within the Gateway - rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) - - message: Combination of port, protocol and hostname must be unique - for each listener - rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol - == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname - == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' - required: - - gatewayClassName - - listeners - type: object - status: - default: - conditions: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: Status defines the current state of Gateway. - properties: - addresses: - description: |+ - Addresses lists the network addresses that have been bound to the - Gateway. - - - This list may differ from the addresses provided in the spec under some - conditions: - - - * no addresses are specified, all addresses are dynamically assigned - * a combination of specified and dynamic addresses are assigned - * a specified address was unusable (e.g. already in use) - - - items: - description: GatewayStatusAddress describes a network address that - is bound to a Gateway. - oneOf: - - properties: - type: - enum: - - IPAddress - value: - anyOf: - - format: ipv4 - - format: ipv6 - - properties: - type: - not: - enum: - - IPAddress - properties: - type: - default: IPAddress - description: Type of the address. - maxLength: 253 - minLength: 1 - pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - value: - description: |- - Value of the address. The validity of the values will depend - on the type and support by the controller. - - - Examples: `1.2.3.4`, `128::1`, `my-ip-address`. - maxLength: 253 - minLength: 1 - type: string - required: - - value - type: object - x-kubernetes-validations: - - message: Hostname value must only contain valid characters (matching - ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) - rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): - true' - maxItems: 16 - type: array - conditions: - default: - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Accepted - - lastTransitionTime: "1970-01-01T00:00:00Z" - message: Waiting for controller - reason: Pending - status: Unknown - type: Programmed - description: |- - Conditions describe the current conditions of the Gateway. - - - Implementations should prefer to express Gateway conditions - using the `GatewayConditionType` and `GatewayConditionReason` - constants so that operators and tools can converge on a common - vocabulary to describe Gateway state. - - - Known condition types are: - - - * "Accepted" - * "Programmed" - * "Ready" - items: - description: "Condition contains details for one aspect of the current - state of this API Resource.\n---\nThis struct is intended for - direct use as an array at the field path .status.conditions. For - example,\n\n\n\ttype FooStatus struct{\n\t // Represents the - observations of a foo's current state.\n\t // Known .status.conditions.type - are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t - \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" - patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - listeners: - description: Listeners provide status for each unique listener port - defined in the Spec. - items: - description: ListenerStatus is the status associated with a Listener. - properties: - attachedRoutes: - description: |- - AttachedRoutes represents the total number of Routes that have been - successfully attached to this Listener. - - - Successful attachment of a Route to a Listener is based solely on the - combination of the AllowedRoutes field on the corresponding Listener - and the Route's ParentRefs field. A Route is successfully attached to - a Listener when it is selected by the Listener's AllowedRoutes field - AND the Route has a valid ParentRef selecting the whole Gateway - resource or a specific Listener as a parent resource (more detail on - attachment semantics can be found in the documentation on the various - Route kinds ParentRefs fields). Listener or Route status does not impact - successful attachment, i.e. the AttachedRoutes field count MUST be set - for Listeners with condition Accepted: false and MUST count successfully - attached Routes that may themselves have Accepted: false conditions. - - - Uses for this field include troubleshooting Route attachment and - measuring blast radius/impact of changes to a Listener. - format: int32 - type: integer - conditions: - description: Conditions describe the current condition of this - listener. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - name: - description: Name is the name of the Listener that this status - corresponds to. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - supportedKinds: - description: |- - SupportedKinds is the list indicating the Kinds supported by this - listener. This MUST represent the kinds an implementation supports for - that Listener configuration. - - - If kinds are specified in Spec that are not supported, they MUST NOT - appear in this list and an implementation MUST set the "ResolvedRefs" - condition to "False" with the "InvalidRouteKinds" reason. If both valid - and invalid Route kinds are specified, the implementation MUST - reference the valid Route kinds that have been specified. - items: - description: RouteGroupKind indicates the group and kind of - a Route resource. - properties: - group: - default: gateway.networking.k8s.io - description: Group is the group of the Route. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is the kind of the Route. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - required: - - kind - type: object - maxItems: 8 - type: array - required: - - attachedRoutes - - conditions - - name - - supportedKinds - type: object - maxItems: 64 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: standard - creationTimestamp: null - name: grpcroutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: GRPCRoute - listKind: GRPCRouteList - plural: grpcroutes - singular: grpcroute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.hostnames - name: Hostnames - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - GRPCRoute provides a way to route gRPC requests. This includes the capability - to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header. - Filters can be used to specify additional processing steps. Backends specify - where matching requests will be routed. - - - GRPCRoute falls under extended support within the Gateway API. Within the - following specification, the word "MUST" indicates that an implementation - supporting GRPCRoute must conform to the indicated requirement, but an - implementation not supporting this route type need not follow the requirement - unless explicitly indicated. - - - Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST - accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via - ALPN. If the implementation does not support this, then it MUST set the - "Accepted" condition to "False" for the affected listener with a reason of - "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections - with an upgrade from HTTP/1. - - - Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST - support HTTP/2 over cleartext TCP (h2c, - https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial - upgrade from HTTP/1.1, i.e. with prior knowledge - (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation - does not support this, then it MUST set the "Accepted" condition to "False" - for the affected listener with a reason of "UnsupportedProtocol". - Implementations MAY also accept HTTP/2 connections with an upgrade from - HTTP/1, i.e. without prior knowledge. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GRPCRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames to match against the GRPC - Host header to select a GRPCRoute to process the request. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label MUST appear by itself as the first label. - - - If a hostname is specified by both the Listener and GRPCRoute, there - MUST be at least one intersecting hostname for the GRPCRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `test.example.com` and `*.example.com` would both match. On the other - hand, `example.com` and `test.example.net` would not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and GRPCRoute have specified hostnames, any - GRPCRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - GRPCRoute specified `test.example.com` and `test.example.net`, - `test.example.net` MUST NOT be considered for a match. - - - If both the Listener and GRPCRoute have specified hostnames, and none - match with the criteria above, then the GRPCRoute MUST NOT be accepted by - the implementation. The implementation MUST raise an 'Accepted' Condition - with a status of `False` in the corresponding RouteParentStatus. - - - If a Route (A) of type HTTPRoute or GRPCRoute is attached to a - Listener and that listener already has another Route (B) of the other - type attached and the intersection of the hostnames of A and B is - non-empty, then the implementation MUST accept exactly one of these two - routes, determined by the following criteria, in order: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - The rejected Route MUST raise an 'Accepted' condition with a status of - 'False' in the corresponding RouteParentStatus. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''')) : true))' - - message: sectionName must be unique when parentRefs includes 2 or - more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)))) - rules: - description: Rules are a list of GRPC matchers, filters and actions. - items: - description: |- - GRPCRouteRule defines the semantics for matching a gRPC request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive an `UNAVAILABLE` status. - - - See the GRPCBackendRef definition for the rules about what makes a single - GRPCBackendRef invalid. - - - When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive an `UNAVAILABLE` status. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status. - Implementations may choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - GRPCBackendRef defines how a GRPCRoute forwards a gRPC request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level MUST be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in GRPCRouteRule.) - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - The effects of ordering of multiple behaviors are currently unspecified. - This can change in the future based on feedback during the alpha stage. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations that support - GRPCRoute. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - If an implementation can not support a combination of filters, it must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - matches: - description: |- - Matches define conditions used for matching the rule against incoming - gRPC requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - method: - service: foo.bar - headers: - values: - version: 2 - - method: - service: foo.bar.v2 - ``` - - - For a request to match against this rule, it MUST satisfy - EITHER of the two conditions: - - - - service of foo.bar AND contains the header `version: 2` - - service of foo.bar.v2 - - - See the documentation for GRPCRouteMatch on how to specify multiple - match conditions to be ANDed together. - - - If no matches are specified, the implementation MUST match every gRPC request. - - - Proxy or Load Balancer routing configuration generated from GRPCRoutes - MUST prioritize rules based on the following criteria, continuing on - ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes. - Precedence MUST be given to the rule with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - * Characters in a matching service. - * Characters in a matching method. - * Header matches. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within the Route that has been given precedence, - matching precedence MUST be granted to the first matching rule meeting - the above criteria. - items: - description: |- - GRPCRouteMatch defines the predicate used to match requests to a given - action. Multiple match types are ANDed together, i.e. the match will - evaluate to true only if all conditions are satisfied. - - - For example, the match below will match a gRPC request only if its service - is `foo` AND it contains the `version: v1` header: - - - ``` - matches: - - method: - type: Exact - service: "foo" - headers: - - name: "version" - value "v1" - - - ``` - properties: - headers: - description: |- - Headers specifies gRPC request header matchers. Multiple match values are - ANDed together, meaning, a request MUST match all the specified headers - to select the route. - items: - description: |- - GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request - headers. - properties: - name: - description: |- - Name is the name of the gRPC Header to be matched. - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: Type specifies how to match against - the value of the header. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of the gRPC Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies a gRPC request service/method matcher. If this field is - not specified, all services and methods will match. - properties: - method: - description: |- - Value of the method to match against. If left empty or omitted, will - match all services. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - service: - description: |- - Value of the service to match against. If left empty or omitted, will - match any service. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - type: - default: Exact - description: |- - Type specifies how to match against the service and/or method. - Support: Core (Exact with service and method specified) - - - Support: Implementation-specific (Exact with method specified but no service specified) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - RegularExpression - type: string - type: object - x-kubernetes-validations: - - message: One or both of 'service' or 'method' must be - specified - rule: 'has(self.type) ? has(self.service) || has(self.method) - : true' - - message: service must only contain valid characters - (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""): - true' - - message: method must only contain valid characters (matching - ^[A-Za-z_][A-Za-z_0-9]*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""): - true' - type: object - maxItems: 8 - type: array - type: object - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of GRPCRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - type: object - served: true - storage: true - subresources: - status: {} - - deprecated: true - deprecationWarning: The v1alpha2 version of GRPCRoute has been deprecated and - will be removed in a future release of the API. Please upgrade to v1. - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - GRPCRoute provides a way to route gRPC requests. This includes the capability - to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header. - Filters can be used to specify additional processing steps. Backends specify - where matching requests will be routed. - - - GRPCRoute falls under extended support within the Gateway API. Within the - following specification, the word "MUST" indicates that an implementation - supporting GRPCRoute must conform to the indicated requirement, but an - implementation not supporting this route type need not follow the requirement - unless explicitly indicated. - - - Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST - accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via - ALPN. If the implementation does not support this, then it MUST set the - "Accepted" condition to "False" for the affected listener with a reason of - "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections - with an upgrade from HTTP/1. - - - Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST - support HTTP/2 over cleartext TCP (h2c, - https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial - upgrade from HTTP/1.1, i.e. with prior knowledge - (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation - does not support this, then it MUST set the "Accepted" condition to "False" - for the affected listener with a reason of "UnsupportedProtocol". - Implementations MAY also accept HTTP/2 connections with an upgrade from - HTTP/1, i.e. without prior knowledge. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of GRPCRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames to match against the GRPC - Host header to select a GRPCRoute to process the request. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label MUST appear by itself as the first label. - - - If a hostname is specified by both the Listener and GRPCRoute, there - MUST be at least one intersecting hostname for the GRPCRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches GRPCRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `test.example.com` and `*.example.com` would both match. On the other - hand, `example.com` and `test.example.net` would not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and GRPCRoute have specified hostnames, any - GRPCRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - GRPCRoute specified `test.example.com` and `test.example.net`, - `test.example.net` MUST NOT be considered for a match. - - - If both the Listener and GRPCRoute have specified hostnames, and none - match with the criteria above, then the GRPCRoute MUST NOT be accepted by - the implementation. The implementation MUST raise an 'Accepted' Condition - with a status of `False` in the corresponding RouteParentStatus. - - - If a Route (A) of type HTTPRoute or GRPCRoute is attached to a - Listener and that listener already has another Route (B) of the other - type attached and the intersection of the hostnames of A and B is - non-empty, then the implementation MUST accept exactly one of these two - routes, determined by the following criteria, in order: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - The rejected Route MUST raise an 'Accepted' condition with a status of - 'False' in the corresponding RouteParentStatus. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''')) : true))' - - message: sectionName must be unique when parentRefs includes 2 or - more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)))) - rules: - description: Rules are a list of GRPC matchers, filters and actions. - items: - description: |- - GRPCRouteRule defines the semantics for matching a gRPC request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive an `UNAVAILABLE` status. - - - See the GRPCBackendRef definition for the rules about what makes a single - GRPCBackendRef invalid. - - - When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive an `UNAVAILABLE` status. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status. - Implementations may choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - GRPCBackendRef defines how a GRPCRoute forwards a gRPC request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level MUST be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in GRPCRouteRule.) - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - The effects of ordering of multiple behaviors are currently unspecified. - This can change in the future based on feedback during the alpha stage. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations that support - GRPCRoute. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - If an implementation can not support a combination of filters, it must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - GRPCRouteFilter defines processing steps that must be completed during the - request or response lifecycle. GRPCRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - Support: Implementation-specific - - - This filter can be used multiple times within the same rule. - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |+ - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations supporting GRPCRoute MUST support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` MUST be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - enum: - - ResponseHeaderModifier - - RequestHeaderModifier - - RequestMirror - - ExtensionRef - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - matches: - description: |- - Matches define conditions used for matching the rule against incoming - gRPC requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - method: - service: foo.bar - headers: - values: - version: 2 - - method: - service: foo.bar.v2 - ``` - - - For a request to match against this rule, it MUST satisfy - EITHER of the two conditions: - - - - service of foo.bar AND contains the header `version: 2` - - service of foo.bar.v2 - - - See the documentation for GRPCRouteMatch on how to specify multiple - match conditions to be ANDed together. - - - If no matches are specified, the implementation MUST match every gRPC request. - - - Proxy or Load Balancer routing configuration generated from GRPCRoutes - MUST prioritize rules based on the following criteria, continuing on - ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes. - Precedence MUST be given to the rule with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - * Characters in a matching service. - * Characters in a matching method. - * Header matches. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within the Route that has been given precedence, - matching precedence MUST be granted to the first matching rule meeting - the above criteria. - items: - description: |- - GRPCRouteMatch defines the predicate used to match requests to a given - action. Multiple match types are ANDed together, i.e. the match will - evaluate to true only if all conditions are satisfied. - - - For example, the match below will match a gRPC request only if its service - is `foo` AND it contains the `version: v1` header: - - - ``` - matches: - - method: - type: Exact - service: "foo" - headers: - - name: "version" - value "v1" - - - ``` - properties: - headers: - description: |- - Headers specifies gRPC request header matchers. Multiple match values are - ANDed together, meaning, a request MUST match all the specified headers - to select the route. - items: - description: |- - GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request - headers. - properties: - name: - description: |- - Name is the name of the gRPC Header to be matched. - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: Type specifies how to match against - the value of the header. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of the gRPC Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies a gRPC request service/method matcher. If this field is - not specified, all services and methods will match. - properties: - method: - description: |- - Value of the method to match against. If left empty or omitted, will - match all services. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - service: - description: |- - Value of the service to match against. If left empty or omitted, will - match any service. - - - At least one of Service and Method MUST be a non-empty string. - maxLength: 1024 - type: string - type: - default: Exact - description: |- - Type specifies how to match against the service and/or method. - Support: Core (Exact with service and method specified) - - - Support: Implementation-specific (Exact with method specified but no service specified) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - RegularExpression - type: string - type: object - x-kubernetes-validations: - - message: One or both of 'service' or 'method' must be - specified - rule: 'has(self.type) ? has(self.service) || has(self.method) - : true' - - message: service must only contain valid characters - (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""): - true' - - message: method must only contain valid characters (matching - ^[A-Za-z_][A-Za-z_0-9]*$) - rule: '(!has(self.type) || self.type == ''Exact'') && - has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""): - true' - type: object - maxItems: 8 - type: array - type: object - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of GRPCRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - type: object - served: false - storage: false -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/standard/gateway.networking.k8s.io_httproutes.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: standard - creationTimestamp: null - name: httproutes.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: HTTPRoute - listKind: HTTPRouteList - plural: httproutes - singular: httproute - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.hostnames - name: Hostnames - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - HTTPRoute provides a way to route HTTP requests. This includes the capability - to match requests by hostname, path, header, or query param. Filters can be - used to specify additional processing steps. Backends specify where matching - requests should be routed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of HTTPRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames that should match against the HTTP Host - header to select a HTTPRoute used to process the request. Implementations - MUST ignore any port value specified in the HTTP Host header while - performing a match and (absent of any applicable header modification - configuration) MUST forward this header unmodified to the backend. - - - Valid values for Hostnames are determined by RFC 1123 definition of a - hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - If a hostname is specified by both the Listener and HTTPRoute, there - must be at least one intersecting hostname for the HTTPRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `*.example.com`, `test.example.com`, and `foo.test.example.com` would - all match. On the other hand, `example.com` and `test.example.net` would - not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and HTTPRoute have specified hostnames, any - HTTPRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - HTTPRoute specified `test.example.com` and `test.example.net`, - `test.example.net` must not be considered for a match. - - - If both the Listener and HTTPRoute have specified hostnames, and none - match with the criteria above, then the HTTPRoute is not accepted. The - implementation must raise an 'Accepted' Condition with a status of - `False` in the corresponding RouteParentStatus. - - - In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. - overlapping wildcard matching and exact matching hostnames), precedence must - be given to rules from the HTTPRoute with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - - - If ties exist across multiple Routes, the matching precedence rules for - HTTPRouteMatches takes over. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''')) : true))' - - message: sectionName must be unique when parentRefs includes 2 or - more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)))) - rules: - default: - - matches: - - path: - type: PathPrefix - value: / - description: Rules are a list of HTTP matchers, filters and actions. - items: - description: |- - HTTPRouteRule defines semantics for matching an HTTP request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive a 500 status code. - - - See the HTTPBackendRef definition for the rules about what makes a single - HTTPBackendRef invalid. - - - When a HTTPBackendRef is invalid, 500 status codes MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive a 500 status code. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic must receive a 500. Implementations may - choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level should be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in HTTPRouteRule.) - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the - filter.type is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != - ''RequestRedirect'')' - - message: filter.requestRedirect must be specified - for RequestRedirect filter.type - rule: '!(!has(self.requestRedirect) && self.type == - ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() - <= 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - Wherever possible, implementations SHOULD implement filters in the order - they are specified. - - - Implementations MAY choose to implement this ordering strictly, rejecting - any combination or order of filters that can not be supported. If implementations - choose a strict interpretation of filter ordering, they MUST clearly document - that behavior. - - - To reject an invalid combination or order of filters, implementations SHOULD - consider the Route Rules with this configuration invalid. If all Route Rules - in a Route are invalid, the entire Route would be considered invalid. If only - a portion of Route Rules are invalid, implementations MUST set the - "PartiallyInvalid" condition for the Route. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - All filters are expected to be compatible with each other except for the - URLRewrite and RequestRedirect filters, which may not be combined. If an - implementation can not support other combinations of filters, they must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the filter.type - is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' - - message: filter.requestRedirect must be specified for RequestRedirect - filter.type - rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') && - self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() <= - 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 - matches: - default: - - path: - type: PathPrefix - value: / - description: |- - Matches define conditions used for matching the rule against incoming - HTTP requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - path: - value: "/foo" - headers: - - name: "version" - value: "v2" - - path: - value: "/v2/foo" - ``` - - - For a request to match against this rule, a request must satisfy - EITHER of the two conditions: - - - - path prefixed with `/foo` AND contains the header `version: v2` - - path prefix of `/v2/foo` - - - See the documentation for HTTPRouteMatch on how to specify multiple - match conditions that should be ANDed together. - - - If no matches are specified, the default is a prefix - path match on "/", which has the effect of matching every - HTTP request. - - - Proxy or Load Balancer routing configuration generated from HTTPRoutes - MUST prioritize matches based on the following criteria, continuing on - ties. Across all rules specified on applicable Routes, precedence must be - given to the match having: - - - * "Exact" path match. - * "Prefix" path match with largest number of characters. - * Method match. - * Largest number of header matches. - * Largest number of query param matches. - - - Note: The precedence of RegularExpression path matches are implementation-specific. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within an HTTPRoute, matching precedence MUST be granted - to the FIRST matching rule (in list order) with a match meeting the above - criteria. - - - When no rules matching a request have been successfully attached to the - parent a request is coming from, a HTTP 404 status code MUST be returned. - items: - description: "HTTPRouteMatch defines the predicate used to - match requests to a given\naction. Multiple match types - are ANDed together, i.e. the match will\nevaluate to true - only if all conditions are satisfied.\n\n\nFor example, - the match below will match a HTTP request only if its path\nstarts - with `/foo` AND it contains the `version: v1` header:\n\n\n```\nmatch:\n\n\n\tpath:\n\t - \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t - \ value \"v1\"\n\n\n```" - properties: - headers: - description: |- - Headers specifies HTTP request header matchers. Multiple match values are - ANDed together, meaning, a request must match all the specified headers - to select the route. - items: - description: |- - HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request - headers. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - - - When a header is repeated in an HTTP request, it is - implementation-specific behavior as to how this is represented. - Generally, proxies should follow the guidance from the RFC: - https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding - processing a repeated header, with special handling for "Set-Cookie". - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the header. - - - Support: Core (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression HeaderMatchType has implementation-specific - conformance, implementations can support POSIX, PCRE or any other dialects - of regular expressions. Please read the implementation's documentation to - determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP Header to - be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies HTTP method matcher. - When specified, this route will be matched only if the request has the - specified method. - - - Support: Extended - enum: - - GET - - HEAD - - POST - - PUT - - DELETE - - CONNECT - - OPTIONS - - TRACE - - PATCH - type: string - path: - default: - type: PathPrefix - value: / - description: |- - Path specifies a HTTP request path matcher. If this field is not - specified, a default prefix match on the "/" path is provided. - properties: - type: - default: PathPrefix - description: |- - Type specifies how to match against the path Value. - - - Support: Core (Exact, PathPrefix) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - PathPrefix - - RegularExpression - type: string - value: - default: / - description: Value of the HTTP path to match against. - maxLength: 1024 - type: string - type: object - x-kubernetes-validations: - - message: value must be an absolute path and start with - '/' when type one of ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') - : true' - - message: must not contain '//' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') - : true' - - message: must not contain '/./' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') - : true' - - message: must not contain '/../' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') - : true' - - message: must not contain '%2f' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') - : true' - - message: must not contain '%2F' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') - : true' - - message: must not contain '#' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') - : true' - - message: must not end with '/..' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') - : true' - - message: must not end with '/.' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') - : true' - - message: type must be one of ['Exact', 'PathPrefix', - 'RegularExpression'] - rule: self.type in ['Exact','PathPrefix'] || self.type - == 'RegularExpression' - - message: must only contain valid characters (matching - ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) - for types ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") - : true' - queryParams: - description: |- - QueryParams specifies HTTP query parameter matchers. Multiple match - values are ANDed together, meaning, a request must match all the - specified query parameters to select the route. - - - Support: Extended - items: - description: |- - HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP - query parameters. - properties: - name: - description: |- - Name is the name of the HTTP query param to be matched. This must be an - exact string match. (See - https://tools.ietf.org/html/rfc7230#section-2.7.3). - - - If multiple entries specify equivalent query param names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent query param name MUST be ignored. - - - If a query param is repeated in an HTTP request, the behavior is - purposely left undefined, since different data planes have different - capabilities. However, it is *recommended* that implementations should - match against the first value of the param if the data plane supports it, - as this behavior is expected in other load balancing contexts outside of - the Gateway API. - - - Users SHOULD NOT route traffic based on repeated query params to guard - themselves against potential differences in the implementations. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the query parameter. - - - Support: Extended (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression QueryParamMatchType has Implementation-specific - conformance, implementations can support POSIX, PCRE or any other - dialects of regular expressions. Please read the implementation's - documentation to determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP query param - to be matched. - maxLength: 1024 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - maxItems: 8 - type: array - type: object - x-kubernetes-validations: - - message: RequestRedirect filter must not be used together with - backendRefs - rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? - (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): - true' - - message: When using RequestRedirect filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - ? ((size(self.matches) != 1 || !has(self.matches[0].path) || - self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: When using URLRewrite filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - - message: Within backendRefs, when using RequestRedirect filter - with path.replacePrefixMatch, exactly one PathPrefix match must - be specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) - || self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: Within backendRefs, When using URLRewrite filter with - path.replacePrefixMatch, exactly one PathPrefix match must be - specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of HTTPRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .spec.hostnames - name: Hostnames - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - HTTPRoute provides a way to route HTTP requests. This includes the capability - to match requests by hostname, path, header, or query param. Filters can be - used to specify additional processing steps. Backends specify where matching - requests should be routed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of HTTPRoute. - properties: - hostnames: - description: |- - Hostnames defines a set of hostnames that should match against the HTTP Host - header to select a HTTPRoute used to process the request. Implementations - MUST ignore any port value specified in the HTTP Host header while - performing a match and (absent of any applicable header modification - configuration) MUST forward this header unmodified to the backend. - - - Valid values for Hostnames are determined by RFC 1123 definition of a - hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - If a hostname is specified by both the Listener and HTTPRoute, there - must be at least one intersecting hostname for the HTTPRoute to be - attached to the Listener. For example: - - - * A Listener with `test.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames, or have specified at - least one of `test.example.com` or `*.example.com`. - * A Listener with `*.example.com` as the hostname matches HTTPRoutes - that have either not specified any hostnames or have specified at least - one hostname that matches the Listener hostname. For example, - `*.example.com`, `test.example.com`, and `foo.test.example.com` would - all match. On the other hand, `example.com` and `test.example.net` would - not match. - - - Hostnames that are prefixed with a wildcard label (`*.`) are interpreted - as a suffix match. That means that a match for `*.example.com` would match - both `test.example.com`, and `foo.test.example.com`, but not `example.com`. - - - If both the Listener and HTTPRoute have specified hostnames, any - HTTPRoute hostnames that do not match the Listener hostname MUST be - ignored. For example, if a Listener specified `*.example.com`, and the - HTTPRoute specified `test.example.com` and `test.example.net`, - `test.example.net` must not be considered for a match. - - - If both the Listener and HTTPRoute have specified hostnames, and none - match with the criteria above, then the HTTPRoute is not accepted. The - implementation must raise an 'Accepted' Condition with a status of - `False` in the corresponding RouteParentStatus. - - - In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. - overlapping wildcard matching and exact matching hostnames), precedence must - be given to rules from the HTTPRoute with the largest number of: - - - * Characters in a matching non-wildcard hostname. - * Characters in a matching hostname. - - - If ties exist across multiple Routes, the matching precedence rules for - HTTPRouteMatches takes over. - - - Support: Core - items: - description: |- - Hostname is the fully qualified domain name of a network host. This matches - the RFC 1123 definition of a hostname with 2 notable exceptions: - - - 1. IPs are not allowed. - 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard - label must appear by itself as the first label. - - - Hostname can be "precise" which is a domain name without the terminating - dot of a network host (e.g. "foo.example.com") or "wildcard", which is a - domain name prefixed with a single wildcard label (e.g. `*.example.com`). - - - Note that as per RFC1035 and RFC1123, a *label* must consist of lower case - alphanumeric characters or '-', and must start and end with an alphanumeric - character. No other punctuation is allowed. - maxLength: 253 - minLength: 1 - pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - maxItems: 16 - type: array - parentRefs: - description: |+ - ParentRefs references the resources (usually Gateways) that a Route wants - to be attached to. Note that the referenced parent resource needs to - allow this for the attachment to be complete. For Gateways, that means - the Gateway needs to allow attachment from Routes of this kind and - namespace. For Services, that means the Service must either be in the same - namespace for a "producer" route, or the mesh implementation must support - and allow "consumer" routes for the referenced Service. ReferenceGrant is - not applicable for governing ParentRefs to Services - it is not possible to - create a "producer" route for a Service in a different namespace from the - Route. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - ParentRefs must be _distinct_. This means either that: - - - * They select different objects. If this is the case, then parentRef - entries are distinct. In terms of fields, this means that the - multi-part key defined by `group`, `kind`, `namespace`, and `name` must - be unique across all parentRef entries in the Route. - * They do not select different objects, but for each optional field used, - each ParentRef that selects the same object must set the same set of - optional fields to different values. If one ParentRef sets a - combination of optional fields, all must set the same combination. - - - Some examples: - - - * If one ParentRef sets `sectionName`, all ParentRefs referencing the - same object must also set `sectionName`. - * If one ParentRef sets `port`, all ParentRefs referencing the same - object must also set `port`. - * If one ParentRef sets `sectionName` and `port`, all ParentRefs - referencing the same object must also set `sectionName` and `port`. - - - It is possible to separately reference multiple distinct objects that may - be collapsed by an implementation. For example, some implementations may - choose to merge compatible Gateway Listeners together. If that is the - case, the list of routes attached to those resources should also be - merged. - - - Note that for ParentRefs that cross namespace boundaries, there are specific - rules. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example, - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable other kinds of cross-namespace reference. - - - - - - - - - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - This API may be extended in the future to support additional kinds of parent - resources. - - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - maxItems: 32 - type: array - x-kubernetes-validations: - - message: sectionName must be specified when parentRefs includes - 2 or more references to the same parent - rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ - == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) - || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName - == '''')) : true))' - - message: sectionName must be unique when parentRefs includes 2 or - more references to the same parent - rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind - == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) - || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ - == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && - p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) - || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName - == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName - == p2.sectionName)))) - rules: - default: - - matches: - - path: - type: PathPrefix - value: / - description: Rules are a list of HTTP matchers, filters and actions. - items: - description: |- - HTTPRouteRule defines semantics for matching an HTTP request based on - conditions (matches), processing it (filters), and forwarding the request to - an API object (backendRefs). - properties: - backendRefs: - description: |- - BackendRefs defines the backend(s) where matching requests should be - sent. - - - Failure behavior here depends on how many BackendRefs are specified and - how many are invalid. - - - If *all* entries in BackendRefs are invalid, and there are also no filters - specified in this route rule, *all* traffic which matches this rule MUST - receive a 500 status code. - - - See the HTTPBackendRef definition for the rules about what makes a single - HTTPBackendRef invalid. - - - When a HTTPBackendRef is invalid, 500 status codes MUST be returned for - requests that would have otherwise been routed to an invalid backend. If - multiple backends are specified, and some are invalid, the proportion of - requests that would otherwise have been routed to an invalid backend - MUST receive a 500 status code. - - - For example, if two backends are specified with equal weights, and one is - invalid, 50 percent of traffic must receive a 500. Implementations may - choose how that 50 percent is determined. - - - Support: Core for Kubernetes Service - - - Support: Extended for Kubernetes ServiceImport - - - Support: Implementation-specific for any other resource - - - Support for weight: Core - items: - description: |- - HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. - - - Note that when a namespace different than the local namespace is specified, a - ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - - - - When the BackendRef points to a Kubernetes Service, implementations SHOULD - honor the appProtocol field if it is set for the target Service Port. - - - Implementations supporting appProtocol SHOULD recognize the Kubernetes - Standard Application Protocols defined in KEP-3726. - - - If a Service appProtocol isn't specified, an implementation MAY infer the - backend protocol through its own means. Implementations MAY infer the - protocol from the Route type referring to the backend Service. - - - If a Route is not able to send traffic to the backend using the specified - protocol then the backend is considered invalid. Implementations MUST set the - "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. - - - - properties: - filters: - description: |- - Filters defined at this level should be executed if and only if the - request is being forwarded to the backend defined here. - - - Support: Implementation-specific (For broader support of filters, use the - Filters field in HTTPRouteRule.) - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For - example "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind - == ''Service'') ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP - Header name and value as defined by RFC - 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP - Header to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified - when type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? - has(self.replaceFullPath) : true' - - message: type must be 'ReplaceFullPath' when - replaceFullPath is set - rule: 'has(self.replaceFullPath) ? self.type - == ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified - when type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' - ? has(self.replacePrefixMatch) : true' - - message: type must be 'ReplacePrefixMatch' - when replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil - if the filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type - != ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type - == ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil - if the filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type - != ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for - RequestMirror filter.type - rule: '!(!has(self.requestMirror) && self.type == - ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the - filter.type is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != - ''RequestRedirect'')' - - message: filter.requestRedirect must be specified - for RequestRedirect filter.type - rule: '!(!has(self.requestRedirect) && self.type == - ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for - ExtensionRef filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') - && self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() - <= 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() - <= 1 - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - weight: - default: 1 - description: |- - Weight specifies the proportion of requests forwarded to the referenced - backend. This is computed as weight/(sum of all weights in this - BackendRefs list). For non-zero values, there may be some epsilon from - the exact proportion defined here depending on the precision an - implementation supports. Weight is not a percentage and the sum of - weights does not need to equal 100. - - - If only one backend is specified and it has a weight greater than 0, 100% - of the traffic is forwarded to that backend. If weight is set to 0, no - traffic should be forwarded for this entry. If unspecified, weight - defaults to 1. - - - Support for this field varies based on the context where used. - format: int32 - maximum: 1000000 - minimum: 0 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - maxItems: 16 - type: array - filters: - description: |- - Filters define the filters that are applied to requests that match - this rule. - - - Wherever possible, implementations SHOULD implement filters in the order - they are specified. - - - Implementations MAY choose to implement this ordering strictly, rejecting - any combination or order of filters that can not be supported. If implementations - choose a strict interpretation of filter ordering, they MUST clearly document - that behavior. - - - To reject an invalid combination or order of filters, implementations SHOULD - consider the Route Rules with this configuration invalid. If all Route Rules - in a Route are invalid, the entire Route would be considered invalid. If only - a portion of Route Rules are invalid, implementations MUST set the - "PartiallyInvalid" condition for the Route. - - - Conformance-levels at this level are defined based on the type of filter: - - - - ALL core filters MUST be supported by all implementations. - - Implementers are encouraged to support extended filters. - - Implementation-specific custom filters have no API guarantees across - implementations. - - - Specifying the same filter multiple times is not supported unless explicitly - indicated in the filter. - - - All filters are expected to be compatible with each other except for the - URLRewrite and RequestRedirect filters, which may not be combined. If an - implementation can not support other combinations of filters, they must clearly - document that limitation. In cases where incompatible or unsupported - filters are specified and cause the `Accepted` condition to be set to status - `False`, implementations may use the `IncompatibleFilters` reason to specify - this configuration error. - - - Support: Core - items: - description: |- - HTTPRouteFilter defines processing steps that must be completed during the - request or response lifecycle. HTTPRouteFilters are meant as an extension - point to express processing that may be done in Gateway implementations. Some - examples include request or response modification, implementing - authentication strategies, rate-limiting, and traffic shaping. API - guarantee/conformance is defined based on the type of the filter. - properties: - extensionRef: - description: |- - ExtensionRef is an optional, implementation-specific extension to the - "filter" behavior. For example, resource "myroutefilter" in group - "networking.example.net"). ExtensionRef MUST NOT be used for core and - extended filters. - - - This filter can be used multiple times within the same rule. - - - Support: Implementation-specific - properties: - group: - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: Kind is kind of the referent. For example - "HTTPRoute" or "Service". - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - - name - type: object - requestHeaderModifier: - description: |- - RequestHeaderModifier defines a schema for a filter that modifies request - headers. - - - Support: Core - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - requestMirror: - description: |- - RequestMirror defines a schema for a filter that mirrors requests. - Requests are sent to the specified destination, but responses from - that destination are ignored. - - - This filter can be used multiple times within the same rule. Note that - not all implementations will be able to support mirroring to multiple - backends. - - - Support: Extended - properties: - backendRef: - description: |- - BackendRef references a resource where mirrored requests are sent. - - - Mirrored requests must be sent only to a single destination endpoint - within this BackendRef, irrespective of how many endpoints are present - within this BackendRef. - - - If the referent cannot be found, this BackendRef is invalid and must be - dropped from the Gateway. The controller must ensure the "ResolvedRefs" - condition on the Route status is set to `status: False` and not configure - this backend in the underlying implementation. - - - If there is a cross-namespace reference to an *existing* object - that is not allowed by a ReferenceGrant, the controller must ensure the - "ResolvedRefs" condition on the Route is set to `status: False`, - with the "RefNotPermitted" reason and not configure this backend in the - underlying implementation. - - - In either error case, the Message of the `ResolvedRefs` Condition - should be used to provide more detail about the problem. - - - Support: Extended for Kubernetes Service - - - Support: Implementation-specific for any other resource - properties: - group: - default: "" - description: |- - Group is the group of the referent. For example, "gateway.networking.k8s.io". - When unspecified or empty string, core API group is inferred. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Service - description: |- - Kind is the Kubernetes resource kind of the referent. For example - "Service". - - - Defaults to "Service" when not specified. - - - ExternalName services can refer to CNAME DNS records that may live - outside of the cluster and as such are difficult to reason about in - terms of conformance. They also may not be safe to forward to (see - CVE-2021-25740 for more information). Implementations SHOULD NOT - support ExternalName Services. - - - Support: Core (Services with a type other than ExternalName) - - - Support: Implementation-specific (Services with type ExternalName) - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: Name is the name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the backend. When unspecified, the local - namespace is inferred. - - - Note that when a namespace different than the local namespace is specified, - a ReferenceGrant object is required in the referent namespace to allow that - namespace's owner to accept the reference. See the ReferenceGrant - documentation for details. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port specifies the destination port number to use for this resource. - Port is required when the referent is a Kubernetes Service. In this - case, the port number is the service port number, not the target port. - For other resources, destination port might be derived from the referent - resource or this field. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - required: - - name - type: object - x-kubernetes-validations: - - message: Must have port for Service reference - rule: '(size(self.group) == 0 && self.kind == ''Service'') - ? has(self.port) : true' - required: - - backendRef - type: object - requestRedirect: - description: |- - RequestRedirect defines a schema for a filter that responds to the - request with an HTTP redirection. - - - Support: Core - properties: - hostname: - description: |- - Hostname is the hostname to be used in the value of the `Location` - header in the response. - When empty, the hostname in the `Host` header of the request is used. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines parameters used to modify the path of the incoming request. - The modified path is then used to construct the `Location` header. When - empty, the request path is used as-is. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - port: - description: |- - Port is the port to be used in the value of the `Location` - header in the response. - - - If no port is specified, the redirect port MUST be derived using the - following rules: - - - * If redirect scheme is not-empty, the redirect port MUST be the well-known - port associated with the redirect scheme. Specifically "http" to port 80 - and "https" to port 443. If the redirect scheme does not have a - well-known port, the listener port of the Gateway SHOULD be used. - * If redirect scheme is empty, the redirect port MUST be the Gateway - Listener port. - - - Implementations SHOULD NOT add the port number in the 'Location' - header in the following cases: - - - * A Location header that will use HTTP (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 80. - * A Location header that will use HTTPS (whether that is determined via - the Listener protocol or the Scheme field) _and_ use port 443. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - scheme: - description: |- - Scheme is the scheme to be used in the value of the `Location` header in - the response. When empty, the scheme of the request is used. - - - Scheme redirects can affect the port of the redirect, for more information, - refer to the documentation for the port field of this filter. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Extended - enum: - - http - - https - type: string - statusCode: - default: 302 - description: |- - StatusCode is the HTTP status code to be used in response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - - - Support: Core - enum: - - 301 - - 302 - type: integer - type: object - responseHeaderModifier: - description: |- - ResponseHeaderModifier defines a schema for a filter that modifies response - headers. - - - Support: Extended - properties: - add: - description: |- - Add adds the given header(s) (name, value) to the request - before the action. It appends to any existing values associated - with the header name. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - add: - - name: "my-header" - value: "bar,baz" - - - Output: - GET /foo HTTP/1.1 - my-header: foo,bar,baz - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - remove: - description: |- - Remove the given header(s) from the HTTP request before the action. The - value of Remove is a list of HTTP header names. Note that the header - names are case-insensitive (see - https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). - - - Input: - GET /foo HTTP/1.1 - my-header1: foo - my-header2: bar - my-header3: baz - - - Config: - remove: ["my-header1", "my-header3"] - - - Output: - GET /foo HTTP/1.1 - my-header2: bar - items: - type: string - maxItems: 16 - type: array - x-kubernetes-list-type: set - set: - description: |- - Set overwrites the request with the given header (name, value) - before the action. - - - Input: - GET /foo HTTP/1.1 - my-header: foo - - - Config: - set: - - name: "my-header" - value: "bar" - - - Output: - GET /foo HTTP/1.1 - my-header: bar - items: - description: HTTPHeader represents an HTTP Header - name and value as defined by RFC 7230. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, the first entry with - an equivalent name MUST be considered for a match. Subsequent entries - with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - value: - description: Value is the value of HTTP Header - to be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - type: - description: |- - Type identifies the type of filter to apply. As with other API fields, - types are classified into three conformance levels: - - - - Core: Filter types and their corresponding configuration defined by - "Support: Core" in this package, e.g. "RequestHeaderModifier". All - implementations must support core filters. - - - - Extended: Filter types and their corresponding configuration defined by - "Support: Extended" in this package, e.g. "RequestMirror". Implementers - are encouraged to support extended filters. - - - - Implementation-specific: Filters that are defined and supported by - specific vendors. - In the future, filters showing convergence in behavior across multiple - implementations will be considered for inclusion in extended or core - conformance levels. Filter-specific configuration for such filters - is specified using the ExtensionRef field. `Type` should be set to - "ExtensionRef" for custom filters. - - - Implementers are encouraged to define custom implementation types to - extend the core API with implementation-specific behavior. - - - If a reference to a custom filter type cannot be resolved, the filter - MUST NOT be skipped. Instead, requests that would have been processed by - that filter MUST receive a HTTP error response. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - RequestHeaderModifier - - ResponseHeaderModifier - - RequestMirror - - RequestRedirect - - URLRewrite - - ExtensionRef - type: string - urlRewrite: - description: |- - URLRewrite defines a schema for a filter that modifies a request during forwarding. - - - Support: Extended - properties: - hostname: - description: |- - Hostname is the value to be used to replace the Host header value during - forwarding. - - - Support: Extended - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - path: - description: |- - Path defines a path rewrite. - - - Support: Extended - properties: - replaceFullPath: - description: |- - ReplaceFullPath specifies the value with which to replace the full path - of a request during a rewrite or redirect. - maxLength: 1024 - type: string - replacePrefixMatch: - description: |- - ReplacePrefixMatch specifies the value with which to replace the prefix - match of a request during a rewrite or redirect. For example, a request - to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch - of "/xyz" would be modified to "/xyz/bar". - - - Note that this matches the behavior of the PathPrefix match type. This - matches full path elements. A path element refers to the list of labels - in the path split by the `/` separator. When specified, a trailing `/` is - ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all - match the prefix `/abc`, but the path `/abcd` would not. - - - ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. - Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in - the implementation setting the Accepted Condition for the Route to `status: False`. - - - Request Path | Prefix Match | Replace Prefix | Modified Path - -------------|--------------|----------------|---------- - /foo/bar | /foo | /xyz | /xyz/bar - /foo/bar | /foo | /xyz/ | /xyz/bar - /foo/bar | /foo/ | /xyz | /xyz/bar - /foo/bar | /foo/ | /xyz/ | /xyz/bar - /foo | /foo | /xyz | /xyz - /foo/ | /foo | /xyz | /xyz/ - /foo/bar | /foo | | /bar - /foo/ | /foo | | / - /foo | /foo | | / - /foo/ | /foo | / | / - /foo | /foo | / | / - maxLength: 1024 - type: string - type: - description: |- - Type defines the type of path modifier. Additional types may be - added in a future release of the API. - - - Note that values may be added to this enum, implementations - must ensure that unknown values will not cause a crash. - - - Unknown values here must result in the implementation setting the - Accepted Condition for the Route to `status: False`, with a - Reason of `UnsupportedValue`. - enum: - - ReplaceFullPath - - ReplacePrefixMatch - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: replaceFullPath must be specified when - type is set to 'ReplaceFullPath' - rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) - : true' - - message: type must be 'ReplaceFullPath' when replaceFullPath - is set - rule: 'has(self.replaceFullPath) ? self.type == - ''ReplaceFullPath'' : true' - - message: replacePrefixMatch must be specified when - type is set to 'ReplacePrefixMatch' - rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) - : true' - - message: type must be 'ReplacePrefixMatch' when - replacePrefixMatch is set - rule: 'has(self.replacePrefixMatch) ? self.type - == ''ReplacePrefixMatch'' : true' - type: object - required: - - type - type: object - x-kubernetes-validations: - - message: filter.requestHeaderModifier must be nil if the - filter.type is not RequestHeaderModifier - rule: '!(has(self.requestHeaderModifier) && self.type != - ''RequestHeaderModifier'')' - - message: filter.requestHeaderModifier must be specified - for RequestHeaderModifier filter.type - rule: '!(!has(self.requestHeaderModifier) && self.type == - ''RequestHeaderModifier'')' - - message: filter.responseHeaderModifier must be nil if the - filter.type is not ResponseHeaderModifier - rule: '!(has(self.responseHeaderModifier) && self.type != - ''ResponseHeaderModifier'')' - - message: filter.responseHeaderModifier must be specified - for ResponseHeaderModifier filter.type - rule: '!(!has(self.responseHeaderModifier) && self.type - == ''ResponseHeaderModifier'')' - - message: filter.requestMirror must be nil if the filter.type - is not RequestMirror - rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' - - message: filter.requestMirror must be specified for RequestMirror - filter.type - rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' - - message: filter.requestRedirect must be nil if the filter.type - is not RequestRedirect - rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' - - message: filter.requestRedirect must be specified for RequestRedirect - filter.type - rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' - - message: filter.urlRewrite must be nil if the filter.type - is not URLRewrite - rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' - - message: filter.urlRewrite must be specified for URLRewrite - filter.type - rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' - - message: filter.extensionRef must be nil if the filter.type - is not ExtensionRef - rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' - - message: filter.extensionRef must be specified for ExtensionRef - filter.type - rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' - maxItems: 16 - type: array - x-kubernetes-validations: - - message: May specify either httpRouteFilterRequestRedirect - or httpRouteFilterRequestRewrite, but not both - rule: '!(self.exists(f, f.type == ''RequestRedirect'') && - self.exists(f, f.type == ''URLRewrite''))' - - message: RequestHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'RequestHeaderModifier').size() - <= 1 - - message: ResponseHeaderModifier filter cannot be repeated - rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() - <= 1 - - message: RequestRedirect filter cannot be repeated - rule: self.filter(f, f.type == 'RequestRedirect').size() <= - 1 - - message: URLRewrite filter cannot be repeated - rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 - matches: - default: - - path: - type: PathPrefix - value: / - description: |- - Matches define conditions used for matching the rule against incoming - HTTP requests. Each match is independent, i.e. this rule will be matched - if **any** one of the matches is satisfied. - - - For example, take the following matches configuration: - - - ``` - matches: - - path: - value: "/foo" - headers: - - name: "version" - value: "v2" - - path: - value: "/v2/foo" - ``` - - - For a request to match against this rule, a request must satisfy - EITHER of the two conditions: - - - - path prefixed with `/foo` AND contains the header `version: v2` - - path prefix of `/v2/foo` - - - See the documentation for HTTPRouteMatch on how to specify multiple - match conditions that should be ANDed together. - - - If no matches are specified, the default is a prefix - path match on "/", which has the effect of matching every - HTTP request. - - - Proxy or Load Balancer routing configuration generated from HTTPRoutes - MUST prioritize matches based on the following criteria, continuing on - ties. Across all rules specified on applicable Routes, precedence must be - given to the match having: - - - * "Exact" path match. - * "Prefix" path match with largest number of characters. - * Method match. - * Largest number of header matches. - * Largest number of query param matches. - - - Note: The precedence of RegularExpression path matches are implementation-specific. - - - If ties still exist across multiple Routes, matching precedence MUST be - determined in order of the following criteria, continuing on ties: - - - * The oldest Route based on creation timestamp. - * The Route appearing first in alphabetical order by - "{namespace}/{name}". - - - If ties still exist within an HTTPRoute, matching precedence MUST be granted - to the FIRST matching rule (in list order) with a match meeting the above - criteria. - - - When no rules matching a request have been successfully attached to the - parent a request is coming from, a HTTP 404 status code MUST be returned. - items: - description: "HTTPRouteMatch defines the predicate used to - match requests to a given\naction. Multiple match types - are ANDed together, i.e. the match will\nevaluate to true - only if all conditions are satisfied.\n\n\nFor example, - the match below will match a HTTP request only if its path\nstarts - with `/foo` AND it contains the `version: v1` header:\n\n\n```\nmatch:\n\n\n\tpath:\n\t - \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t - \ value \"v1\"\n\n\n```" - properties: - headers: - description: |- - Headers specifies HTTP request header matchers. Multiple match values are - ANDed together, meaning, a request must match all the specified headers - to select the route. - items: - description: |- - HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request - headers. - properties: - name: - description: |- - Name is the name of the HTTP Header to be matched. Name matching MUST be - case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). - - - If multiple entries specify equivalent header names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent header name MUST be ignored. Due to the - case-insensitivity of header names, "foo" and "Foo" are considered - equivalent. - - - When a header is repeated in an HTTP request, it is - implementation-specific behavior as to how this is represented. - Generally, proxies should follow the guidance from the RFC: - https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding - processing a repeated header, with special handling for "Set-Cookie". - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the header. - - - Support: Core (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression HeaderMatchType has implementation-specific - conformance, implementations can support POSIX, PCRE or any other dialects - of regular expressions. Please read the implementation's documentation to - determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP Header to - be matched. - maxLength: 4096 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - method: - description: |- - Method specifies HTTP method matcher. - When specified, this route will be matched only if the request has the - specified method. - - - Support: Extended - enum: - - GET - - HEAD - - POST - - PUT - - DELETE - - CONNECT - - OPTIONS - - TRACE - - PATCH - type: string - path: - default: - type: PathPrefix - value: / - description: |- - Path specifies a HTTP request path matcher. If this field is not - specified, a default prefix match on the "/" path is provided. - properties: - type: - default: PathPrefix - description: |- - Type specifies how to match against the path Value. - - - Support: Core (Exact, PathPrefix) - - - Support: Implementation-specific (RegularExpression) - enum: - - Exact - - PathPrefix - - RegularExpression - type: string - value: - default: / - description: Value of the HTTP path to match against. - maxLength: 1024 - type: string - type: object - x-kubernetes-validations: - - message: value must be an absolute path and start with - '/' when type one of ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') - : true' - - message: must not contain '//' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') - : true' - - message: must not contain '/./' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') - : true' - - message: must not contain '/../' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') - : true' - - message: must not contain '%2f' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') - : true' - - message: must not contain '%2F' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') - : true' - - message: must not contain '#' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') - : true' - - message: must not end with '/..' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') - : true' - - message: must not end with '/.' when type one of ['Exact', - 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') - : true' - - message: type must be one of ['Exact', 'PathPrefix', - 'RegularExpression'] - rule: self.type in ['Exact','PathPrefix'] || self.type - == 'RegularExpression' - - message: must only contain valid characters (matching - ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) - for types ['Exact', 'PathPrefix'] - rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") - : true' - queryParams: - description: |- - QueryParams specifies HTTP query parameter matchers. Multiple match - values are ANDed together, meaning, a request must match all the - specified query parameters to select the route. - - - Support: Extended - items: - description: |- - HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP - query parameters. - properties: - name: - description: |- - Name is the name of the HTTP query param to be matched. This must be an - exact string match. (See - https://tools.ietf.org/html/rfc7230#section-2.7.3). - - - If multiple entries specify equivalent query param names, only the first - entry with an equivalent name MUST be considered for a match. Subsequent - entries with an equivalent query param name MUST be ignored. - - - If a query param is repeated in an HTTP request, the behavior is - purposely left undefined, since different data planes have different - capabilities. However, it is *recommended* that implementations should - match against the first value of the param if the data plane supports it, - as this behavior is expected in other load balancing contexts outside of - the Gateway API. - - - Users SHOULD NOT route traffic based on repeated query params to guard - themselves against potential differences in the implementations. - maxLength: 256 - minLength: 1 - pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ - type: string - type: - default: Exact - description: |- - Type specifies how to match against the value of the query parameter. - - - Support: Extended (Exact) - - - Support: Implementation-specific (RegularExpression) - - - Since RegularExpression QueryParamMatchType has Implementation-specific - conformance, implementations can support POSIX, PCRE or any other - dialects of regular expressions. Please read the implementation's - documentation to determine the supported dialect. - enum: - - Exact - - RegularExpression - type: string - value: - description: Value is the value of HTTP query param - to be matched. - maxLength: 1024 - minLength: 1 - type: string - required: - - name - - value - type: object - maxItems: 16 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - maxItems: 8 - type: array - type: object - x-kubernetes-validations: - - message: RequestRedirect filter must not be used together with - backendRefs - rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? - (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): - true' - - message: When using RequestRedirect filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - ? ((size(self.matches) != 1 || !has(self.matches[0].path) || - self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: When using URLRewrite filter with path.replacePrefixMatch, - exactly one PathPrefix match must be specified - rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - - message: Within backendRefs, when using RequestRedirect filter - with path.replacePrefixMatch, exactly one PathPrefix match must - be specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) - && has(f.requestRedirect.path) && f.requestRedirect.path.type - == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) - )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) - || self.matches[0].path.type != ''PathPrefix'') ? false : true) - : true' - - message: Within backendRefs, When using URLRewrite filter with - path.replacePrefixMatch, exactly one PathPrefix match must be - specified - rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, - (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) - && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' - && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) - != 1 || !has(self.matches[0].path) || self.matches[0].path.type - != ''PathPrefix'') ? false : true) : true' - maxItems: 16 - type: array - type: object - status: - description: Status defines the current state of HTTPRoute. - properties: - parents: - description: |- - Parents is a list of parent resources (usually Gateways) that are - associated with the route, and the status of the route with respect to - each parent. When this route attaches to a parent, the controller that - manages the parent must add an entry to this list when the controller - first sees the route and should update the entry as appropriate when the - route or gateway is modified. - - - Note that parent references that cannot be resolved by an implementation - of this API will not be added to this list. Implementations of this API - can only populate Route status for the Gateways/parent resources they are - responsible for. - - - A maximum of 32 Gateways will be represented in this list. An empty list - means the route has not been attached to any Gateway. - items: - description: |- - RouteParentStatus describes the status of a route with respect to an - associated Parent. - properties: - conditions: - description: |- - Conditions describes the status of the route with respect to the Gateway. - Note that the route's availability is also subject to the Gateway's own - status conditions and listener status. - - - If the Route's ParentRef specifies an existing Gateway that supports - Routes of this kind AND that Gateway's controller has sufficient access, - then that Gateway's controller MUST set the "Accepted" condition on the - Route, to indicate whether the route has been accepted or rejected by the - Gateway, and why. - - - A Route MUST be considered "Accepted" if at least one of the Route's - rules is implemented by the Gateway. - - - There are a number of cases where the "Accepted" condition may not be set - due to lack of controller visibility, that includes when: - - - * The Route refers to a non-existent parent. - * The Route is of a type that the controller does not support. - * The Route is in a namespace the controller does not have access to. - items: - description: "Condition contains details for one aspect of - the current state of this API Resource.\n---\nThis struct - is intended for direct use as an array at the field path - .status.conditions. For example,\n\n\n\ttype FooStatus - struct{\n\t // Represents the observations of a foo's - current state.\n\t // Known .status.conditions.type are: - \"Available\", \"Progressing\", and \"Degraded\"\n\t // - +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // - +listType=map\n\t // +listMapKey=type\n\t Conditions - []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" - patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t - \ // other fields\n\t}" - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - type of condition in CamelCase or in foo.example.com/CamelCase. - --- - Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be - useful (see .node.status.conditions), the ability to deconflict is important. - The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - maxItems: 8 - minItems: 1 - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - controllerName: - description: |- - ControllerName is a domain/path string that indicates the name of the - controller that wrote this status. This corresponds with the - controllerName field on GatewayClass. - - - Example: "example.net/gateway-controller". - - - The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are - valid Kubernetes names - (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). - - - Controllers MUST populate this field when writing status. Controllers should ensure that - entries to status populated with their ControllerName are cleaned up when they are no - longer necessary. - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ - type: string - parentRef: - description: |- - ParentRef corresponds with a ParentRef in the spec that this - RouteParentStatus struct describes the status of. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - - There are two kinds of parent resources with "Core" support: - - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - required: - - controllerName - - parentRef - type: object - maxItems: 32 - type: array - required: - - parents - type: object - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null ---- -# -# config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml -# -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/2997 - gateway.networking.k8s.io/bundle-version: v1.1.0 - gateway.networking.k8s.io/channel: standard - creationTimestamp: null - name: referencegrants.gateway.networking.k8s.io -spec: - group: gateway.networking.k8s.io - names: - categories: - - gateway-api - kind: ReferenceGrant - listKind: ReferenceGrantList - plural: referencegrants - shortNames: - - refgrant - singular: referencegrant - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - deprecated: true - deprecationWarning: The v1alpha2 version of ReferenceGrant has been deprecated - and will be removed in a future release of the API. Please upgrade to v1beta1. - name: v1alpha2 - schema: - openAPIV3Schema: - description: |- - ReferenceGrant identifies kinds of resources in other namespaces that are - trusted to reference the specified kinds of resources in the same namespace - as the policy. - - - Each ReferenceGrant can be used to represent a unique trust relationship. - Additional Reference Grants can be used to add to the set of trusted - sources of inbound references for the namespace they are defined within. - - - A ReferenceGrant is required for all cross-namespace references in Gateway API - (with the exception of cross-namespace Route-Gateway attachment, which is - governed by the AllowedRoutes configuration on the Gateway, and cross-namespace - Service ParentRefs on a "consumer" mesh Route, which defines routing rules - applicable only to workloads in the Route namespace). ReferenceGrants allowing - a reference from a Route to a Service are only applicable to BackendRefs. - - - ReferenceGrant is a form of runtime verification allowing users to assert - which cross-namespace object references are permitted. Implementations that - support ReferenceGrant MUST NOT permit cross-namespace references which have - no grant, and MUST respond to the removal of a grant by revoking the access - that the grant allowed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of ReferenceGrant. - properties: - from: - description: |- - From describes the trusted namespaces and kinds that can reference the - resources described in "To". Each entry in this list MUST be considered - to be an additional place that references can be valid from, or to put - this another way, entries MUST be combined using OR. - - - Support: Core - items: - description: ReferenceGrantFrom describes trusted namespaces and - kinds. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field. - - - When used to permit a SecretObjectReference: - - - * Gateway - - - When used to permit a BackendObjectReference: - - - * GRPCRoute - * HTTPRoute - * TCPRoute - * TLSRoute - * UDPRoute - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - namespace - type: object - maxItems: 16 - minItems: 1 - type: array - to: - description: |- - To describes the resources that may be referenced by the resources - described in "From". Each entry in this list MUST be considered to be an - additional place that references can be valid to, or to put this another - way, entries MUST be combined using OR. - - - Support: Core - items: - description: |- - ReferenceGrantTo describes what Kinds are allowed as targets of the - references. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field: - - - * Secret when used to permit a SecretObjectReference - * Service when used to permit a BackendObjectReference - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. When unspecified, this policy - refers to all resources of the specified Group and Kind in the local - namespace. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - from - - to - type: object - type: object - served: false - storage: false - subresources: {} - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - ReferenceGrant identifies kinds of resources in other namespaces that are - trusted to reference the specified kinds of resources in the same namespace - as the policy. - - - Each ReferenceGrant can be used to represent a unique trust relationship. - Additional Reference Grants can be used to add to the set of trusted - sources of inbound references for the namespace they are defined within. - - - All cross-namespace references in Gateway API (with the exception of cross-namespace - Gateway-route attachment) require a ReferenceGrant. - - - ReferenceGrant is a form of runtime verification allowing users to assert - which cross-namespace object references are permitted. Implementations that - support ReferenceGrant MUST NOT permit cross-namespace references which have - no grant, and MUST respond to the removal of a grant by revoking the access - that the grant allowed. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec defines the desired state of ReferenceGrant. - properties: - from: - description: |- - From describes the trusted namespaces and kinds that can reference the - resources described in "To". Each entry in this list MUST be considered - to be an additional place that references can be valid from, or to put - this another way, entries MUST be combined using OR. - - - Support: Core - items: - description: ReferenceGrantFrom describes trusted namespaces and - kinds. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field. - - - When used to permit a SecretObjectReference: - - - * Gateway - - - When used to permit a BackendObjectReference: - - - * GRPCRoute - * HTTPRoute - * TCPRoute - * TLSRoute - * UDPRoute - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - namespace: - description: |- - Namespace is the namespace of the referent. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - required: - - group - - kind - - namespace - type: object - maxItems: 16 - minItems: 1 - type: array - to: - description: |- - To describes the resources that may be referenced by the resources - described in "From". Each entry in this list MUST be considered to be an - additional place that references can be valid to, or to put this another - way, entries MUST be combined using OR. - - - Support: Core - items: - description: |- - ReferenceGrantTo describes what Kinds are allowed as targets of the - references. - properties: - group: - description: |- - Group is the group of the referent. - When empty, the Kubernetes core API group is inferred. - - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: |- - Kind is the kind of the referent. Although implementations may support - additional resources, the following types are part of the "Core" - support level for this field: - - - * Secret when used to permit a SecretObjectReference - * Service when used to permit a BackendObjectReference - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. When unspecified, this policy - refers to all resources of the specified Group and Kind in the local - namespace. - maxLength: 253 - minLength: 1 - type: string - required: - - group - - kind - type: object - maxItems: 16 - minItems: 1 - type: array - required: - - from - - to - type: object - type: object - served: true - storage: true - subresources: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: null - storedVersions: null diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS b/kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS deleted file mode 100644 index a80e724..0000000 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - kubespray-approvers -reviewers: - - kubespray-reviewers diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2 b/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2 index df18a7d..1b9e1de 100644 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2 @@ -51,16 +51,30 @@ spec: type: date schema: openAPIV3Schema: - description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. + description: |- + A ClusterIssuer represents a certificate issuing authority which can be + referenced as part of `issuerRef` fields. + It is similar to an Issuer, however it is cluster-scoped and therefore can + be referenced by resources that exist in *any* namespace, not just the same + namespace as the referent. type: object required: - spec properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -69,34 +83,65 @@ spec: type: object properties: acme: - description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + description: |- + ACME configures this issuer to communicate with a RFC8555 (ACME) server + to obtain signed x509 certificates. type: object required: - privateKeySecretRef - server properties: caBundle: - description: Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. + description: |- + Base64-encoded bundle of PEM CAs which can be used to validate the certificate + chain presented by the ACME server. + Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various + kinds of security vulnerabilities. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. type: string format: byte disableAccountKeyGeneration: - description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + description: |- + Enables or disables generating a new ACME account key. + If true, the Issuer resource will *not* request a new account but will expect + the account key to be supplied via an existing secret. + If false, the cert-manager system will generate a new ACME account key + for the Issuer. + Defaults to false. type: boolean email: - description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + description: |- + Email is the email address to be associated with the ACME account. + This field is optional, but it is strongly recommended to be set. + It will be used to contact you in case of issues with your account or + certificates, including expiry notification emails. + This field may be updated after the account is initially registered. type: string enableDurationFeature: - description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + description: |- + Enables requesting a Not After date on certificates that matches the + duration of the certificate. This is not supported by all ACME servers + like Let's Encrypt. If set to true when the ACME server does not support + it, it will create an error on the Order. + Defaults to false. type: boolean externalAccountBinding: - description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + description: |- + ExternalAccountBinding is a reference to a CA external account of the ACME + server. + If set, upon registration cert-manager will attempt to associate the given + external account credentials with the registered ACME account. type: object required: - keyID - keySecretRef properties: keyAlgorithm: - description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + description: |- + Deprecated: keyAlgorithm field exists for historical compatibility + reasons and should not be used. The algorithm is now hardcoded to HS256 + in golang/x/crypto/acme. type: string enum: - HS256 @@ -106,68 +151,130 @@ spec: description: keyID is the ID of the CA key that the External Account is bound to. type: string keySecretRef: - description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + description: |- + keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes + Secret which holds the symmetric MAC key of the External Account Binding. + The `key` is the index string that is paired with the key data in the + Secret and should not be confused with the key data itself, or indeed with + the External Account Binding keyID above. + The secret key stored in the Secret **must** be un-padded, base64 URL + encoded data. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string preferredChain: - description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + description: |- + PreferredChain is the chain to use if the ACME server outputs multiple. + PreferredChain is no guarantee that this one gets delivered by the ACME + endpoint. + For example, for Let's Encrypt's DST crosssign you would use: + "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. + This value picks the first certificate bundle in the combined set of + ACME default and alternative chains that has a root-most certificate with + this value as its issuer's commonname. type: string maxLength: 64 privateKeySecretRef: - description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + description: |- + PrivateKey is the name of a Kubernetes Secret resource that will be used to + store the automatically generated ACME account private key. + Optionally, a `key` may be specified to select a specific entry within + the named Secret resource. + If `key` is not specified, a default of `tls.key` will be used. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string server: - description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + description: |- + Server is the URL used to access the ACME server's 'directory' endpoint. + For example, for Let's Encrypt's staging endpoint, you would use: + "https://acme-staging-v02.api.letsencrypt.org/directory". + Only ACME v2 endpoints (i.e. RFC 8555) are supported. type: string skipTLSVerify: - description: 'INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.' + description: |- + INSECURE: Enables or disables validation of the ACME server TLS certificate. + If true, requests to the ACME server will not have the TLS certificate chain + validated. + Mutually exclusive with CABundle; prefer using CABundle to prevent various + kinds of security vulnerabilities. + Only enable this option in development environments. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + Defaults to false. type: boolean solvers: - description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + description: |- + Solvers is a list of challenge solvers that will be used to solve + ACME challenges for the matching domains. + Solver configurations must be provided in order to obtain certificates + from an ACME server. + For more information, see: https://cert-manager.io/docs/configuration/acme/ type: array items: - description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. + description: |- + An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. + A selector may be provided to use different solving strategies for different DNS names. + Only one of HTTP01 or DNS01 must be provided. type: object properties: dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. type: object properties: acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. type: object required: - accountSecretRef - host properties: accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string host: type: string @@ -181,40 +288,61 @@ spec: - serviceConsumerDomain properties: accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string serviceConsumerDomain: type: string @@ -226,19 +354,30 @@ spec: - subscriptionID properties: clientID: - description: 'Auth: Azure Service Principal: The ClientID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientSecret and TenantID must also be set.' + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. type: string clientSecretSecretRef: - description: 'Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set.' + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string environment: description: name of the Azure environment (default AzurePublicCloud) @@ -252,14 +391,19 @@ spec: description: name of the DNS zone that should be used type: string managedIdentity: - description: 'Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.' + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. type: object properties: clientID: description: client ID of the managed identity, can not be used at the same time as resourceID type: string resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity type: string resourceGroupName: description: resource group the DNS zone is located in @@ -268,7 +412,10 @@ spec: description: ID of the Azure subscription type: string tenantID: - description: 'Auth: Azure Service Principal: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set.' + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. type: string cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. @@ -277,37 +424,55 @@ spec: - project properties: hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. type: string project: type: string serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. type: object properties: apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string apiTokenSecretRef: description: API token used to authenticate with Cloudflare. @@ -316,16 +481,23 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string email: description: Email of the account, only required when using API key based authentication. type: string cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. type: string enum: - None @@ -337,43 +509,69 @@ spec: - tokenSecretRef properties: tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. type: object required: - nameserver properties: nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. type: string tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. type: string tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. type: string tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string route53: description: Use the AWS Route53 API to manage DNS01 challenge records. @@ -382,20 +580,71 @@ spec: - region properties: accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. type: string @@ -403,113 +652,301 @@ spec: description: Always set the region when using AccessKeyID and SecretAccessKey type: string role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata type: string secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. type: object required: - groupName - solverName properties: config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. x-kubernetes-preserve-unknown-fields: true groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. type: string solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. type: string http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. type: object properties: gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. type: object properties: labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. type: object additionalProperties: type: string parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways type: array items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). There are two kinds of parent resources with \"Core\" support: \n * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, experimental, ClusterIP Services only) \n This API may be extended in the future to support additional kinds of parent resources. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + + This API may be extended in the future to support additional kinds of parent + resources. + + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. type: object required: - name properties: group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + + Support: Core type: string default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ kind: - description: "Kind is kind of the referent. \n There are two kinds of parent resources with \"Core\" support: \n * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, experimental, ClusterIP Services only) \n Support for other resources is Implementation-Specific." + description: |- + Kind is kind of the referent. + + + There are two kinds of parent resources with "Core" support: + + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + + Support for other resources is Implementation-Specific. type: string default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ name: - description: "Name is the name of the referent. \n Support: Core" + description: |- + Name is the name of the referent. + + + Support: Core type: string maxLength: 253 minLength: 1 namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. \n Support: Core" + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + + Support: Core type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + + Support: Extended type: integer format: int32 maximum: 65535 minimum: 1 sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. * Service: Port Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. Note that attaching Routes to Services as Parents is part of experimental Mesh support and is not supported for any other purpose. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + + Support: Core type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. type: string ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. type: object properties: class: - description: This field configures the annotation `kubernetes.io/ingress.class` when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. type: string ingressClassName: - description: This field configures the field `ingressClassName` on the created Ingress resources used to solve ACME challenges that use this challenge solver. This is the recommended way of configuring the ingress class. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. type: string ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. type: object properties: metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. type: object properties: annotations: @@ -523,14 +960,26 @@ spec: additionalProperties: type: string name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. type: string podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. type: object properties: metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. type: object properties: annotations: @@ -544,7 +993,10 @@ spec: additionalProperties: type: string spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. type: object properties: affinity: @@ -556,10 +1008,21 @@ spec: type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. type: array items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). type: object required: - preference @@ -573,7 +1036,9 @@ spec: description: A list of node selector requirements by node's labels. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -583,18 +1048,29 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -604,20 +1080,35 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. type: object required: - nodeSelectorTerms @@ -626,14 +1117,19 @@ spec: description: Required. A list of node selector terms. The terms are ORed. type: array items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -643,18 +1139,29 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -664,21 +1171,40 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -694,14 +1220,18 @@ spec: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -711,40 +1241,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -754,49 +1320,90 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. type: array items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running type: object required: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -806,40 +1413,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -849,33 +1492,64 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string + x-kubernetes-list-type: atomic podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -891,14 +1565,18 @@ spec: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -908,40 +1586,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -951,49 +1665,90 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. type: array items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running type: object required: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -1003,40 +1758,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -1046,40 +1837,75 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string + x-kubernetes-list-type: atomic imagePullSecrets: description: If specified, the pod's imagePullSecrets type: array items: - description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. type: object properties: name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + TODO: Add other useful fields. apiVersion, kind, uid? + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896. type: string + default: "" x-kubernetes-map-type: atomic nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object additionalProperties: type: string @@ -1093,82 +1919,146 @@ spec: description: If specified, the pod's tolerations. type: array items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . type: object properties: effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. type: integer format: int64 value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. type: string selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. type: object properties: dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. type: array items: type: string dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. type: array items: type: string matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. type: object additionalProperties: type: string ca: - description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + description: |- + CA configures this issuer to sign certificates using a signing CA keypair + stored in a Secret resource. + This is used to build internal PKIs that are managed by cert-manager. type: object required: - secretName properties: crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set, certificates will be issued without distribution points set. type: array items: type: string issuingCertificateURLs: - description: IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be "http://ca.domain.com/ca.crt". + description: |- + IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates + it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. + As an example, such a URL might be "http://ca.domain.com/ca.crt". type: array items: type: string ocspServers: - description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + description: |- + The OCSP server list is an X.509 v3 extension that defines a list of + URLs of OCSP responders. The OCSP responders can be queried for the + revocation status of an issued certificate. If not set, the + certificate will be issued with no OCSP servers set. For example, an + OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". type: array items: type: string secretName: - description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + description: |- + SecretName is the name of the secret used to sign Certificates issued + by this Issuer. type: string selfSigned: - description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + description: |- + SelfSigned configures this issuer to 'self sign' certificates using the + private key used to create the CertificateRequest object. type: object properties: crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set certificate will be issued without CDP. Values are strings. type: array items: type: string vault: - description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + description: |- + Vault configures this issuer to sign certificates using a HashiCorp Vault + PKI backend. type: object required: - auth @@ -1180,7 +2070,9 @@ spec: type: object properties: appRole: - description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. type: object required: - path @@ -1188,53 +2080,94 @@ spec: - secretRef properties: path: - description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + description: |- + Path where the App Role authentication backend is mounted in Vault, e.g: + "approle" type: string roleId: - description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. type: string secretRef: - description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string kubernetes: - description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. type: object required: - role properties: mountPath: - description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/kubernetes" will be used. type: string role: - description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. type: string secretRef: - description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + description: |- + The required Secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. Use of 'ambient credentials' is not + supported. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string serviceAccountRef: - description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). Compared to using "secretRef", + using this field means that you don't rely on statically bound tokens. To + use this field, you must configure an RBAC rule to let cert-manager + request a token. type: object required: - name properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token + consisting of the issuer's namespace and name is always included. + type: array + items: + type: string name: description: Name of the ServiceAccount used to request a token. type: string @@ -1245,44 +2178,112 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by Vault. Only used if using HTTPS to connect to Vault and ignored for HTTP connections. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by Vault. Only used if using HTTPS to connect to Vault and + ignored for HTTP connections. + Mutually exclusive with CABundleSecretRef. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. type: string format: byte caBundleSecretRef: - description: Reference to a Secret containing a bundle of PEM-encoded CAs to use when verifying the certificate chain presented by Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + description: |- + Reference to a Secret containing a bundle of PEM-encoded CAs to use when + verifying the certificate chain presented by Vault when using HTTPS. + Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + If no key for the Secret is specified, cert-manager will default to 'ca.crt'. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientCertSecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Certificate to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientKeySecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Private Key to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string namespace: - description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces type: string path: - description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + description: |- + Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: + "my_pki_mount/sign/my-role-name". type: string server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string venafi: - description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + description: |- + Venafi configures this issuer to sign certificates using a Venafi TPP + or Venafi Cloud policy zone. type: object required: - zone properties: cloud: - description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + description: |- + Cloud specifies the Venafi cloud configuration settings. + Only one of TPP or Cloud may be specified. type: object required: - apiTokenSecretRef @@ -1294,59 +2295,96 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string url: - description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + description: |- + URL is the base URL for Venafi Cloud. + Defaults to "https://api.venafi.cloud/v1". type: string tpp: - description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + description: |- + TPP specifies Trust Protection Platform configuration settings. + Only one of TPP or Cloud may be specified. type: object required: - credentialsRef - url properties: caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + If undefined, the certificate bundle in the cert-manager controller container + is used to validate the chain. type: string format: byte credentialsRef: - description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + description: |- + CredentialsRef is a reference to a Secret containing the username and + password for the TPP server. + The secret must contain two keys, 'username' and 'password'. type: object required: - name properties: name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string url: - description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + description: |- + URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + for example: "https://tpp.example.com/vedsdk". type: string zone: - description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + description: |- + Zone is the Venafi Policy Zone to use for this issuer. + All requests made to the Venafi platform will be restricted by the named + zone policy. + This field is required. type: string status: description: Status of the ClusterIssuer. This is set and managed automatically. type: object properties: acme: - description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. type: object properties: lastPrivateKeyHash: - description: LastPrivateKeyHash is a hash of the private key associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer type: string lastRegisteredEmail: - description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer type: string uri: - description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA type: string conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. type: array items: description: IssuerCondition contains condition information for an Issuer. @@ -1356,18 +2394,29 @@ spec: - type properties: lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. type: string format: date-time message: - description: Message is a human readable description of the details of the last transition, complementing reason. + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. type: string observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. type: integer format: int64 reason: - description: Reason is a brief machine readable explanation for the condition's last transition. + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). @@ -1433,10 +2482,19 @@ spec: - spec properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -1453,13 +2511,23 @@ spec: - url properties: authorizationURL: - description: The URL to the ACME Authorization resource that this challenge is a part of. + description: |- + The URL to the ACME Authorization resource that this + challenge is a part of. type: string dnsName: - description: dnsName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. + description: |- + dnsName is the identifier that this challenge is for, e.g. example.com. + If the requested DNSName is a 'wildcard', this field MUST be set to the + non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. type: string issuerRef: - description: References a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. + description: |- + References a properly configured ACME-type Issuer which should + be used to create this Challenge. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Challenge will be marked as failed. type: object required: - name @@ -1474,34 +2542,54 @@ spec: description: Name of the resource being referred to. type: string key: - description: 'The ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' + description: |- + The ACME challenge key for this challenge + For HTTP01 challenges, this is the value that must be responded with to + complete the HTTP01 challenge in the format: + `.`. + For DNS01 challenges, this is the base64 encoded SHA256 sum of the + `.` + text that must be set as the TXT record content. type: string solver: - description: Contains the domain solving configuration that should be used to solve this challenge resource. + description: |- + Contains the domain solving configuration that should be used to + solve this challenge resource. type: object properties: dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. type: object properties: acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. type: object required: - accountSecretRef - host properties: accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string host: type: string @@ -1515,40 +2603,61 @@ spec: - serviceConsumerDomain properties: accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string serviceConsumerDomain: type: string @@ -1560,19 +2669,30 @@ spec: - subscriptionID properties: clientID: - description: 'Auth: Azure Service Principal: The ClientID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientSecret and TenantID must also be set.' + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. type: string clientSecretSecretRef: - description: 'Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set.' + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string environment: description: name of the Azure environment (default AzurePublicCloud) @@ -1586,14 +2706,19 @@ spec: description: name of the DNS zone that should be used type: string managedIdentity: - description: 'Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.' + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. type: object properties: clientID: description: client ID of the managed identity, can not be used at the same time as resourceID type: string resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity type: string resourceGroupName: description: resource group the DNS zone is located in @@ -1602,7 +2727,10 @@ spec: description: ID of the Azure subscription type: string tenantID: - description: 'Auth: Azure Service Principal: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set.' + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. type: string cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. @@ -1611,37 +2739,55 @@ spec: - project properties: hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. type: string project: type: string serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. type: object properties: apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string apiTokenSecretRef: description: API token used to authenticate with Cloudflare. @@ -1650,16 +2796,23 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string email: description: Email of the account, only required when using API key based authentication. type: string cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. type: string enum: - None @@ -1671,43 +2824,69 @@ spec: - tokenSecretRef properties: tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. type: object required: - nameserver properties: nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. type: string tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. type: string tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. type: string tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string route53: description: Use the AWS Route53 API to manage DNS01 challenge records. @@ -1716,20 +2895,71 @@ spec: - region properties: accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. type: string @@ -1737,113 +2967,301 @@ spec: description: Always set the region when using AccessKeyID and SecretAccessKey type: string role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata type: string secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. type: object required: - groupName - solverName properties: config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. x-kubernetes-preserve-unknown-fields: true groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. type: string solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. type: string http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. type: object properties: gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. type: object properties: labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. type: object additionalProperties: type: string parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways type: array items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). There are two kinds of parent resources with \"Core\" support: \n * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, experimental, ClusterIP Services only) \n This API may be extended in the future to support additional kinds of parent resources. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + + This API may be extended in the future to support additional kinds of parent + resources. + + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. type: object required: - name properties: group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + + Support: Core type: string default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ kind: - description: "Kind is kind of the referent. \n There are two kinds of parent resources with \"Core\" support: \n * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, experimental, ClusterIP Services only) \n Support for other resources is Implementation-Specific." + description: |- + Kind is kind of the referent. + + + There are two kinds of parent resources with "Core" support: + + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + + Support for other resources is Implementation-Specific. type: string default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ name: - description: "Name is the name of the referent. \n Support: Core" + description: |- + Name is the name of the referent. + + + Support: Core type: string maxLength: 253 minLength: 1 namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. \n Support: Core" + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + + Support: Core type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + + Support: Extended type: integer format: int32 maximum: 65535 minimum: 1 sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. * Service: Port Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. Note that attaching Routes to Services as Parents is part of experimental Mesh support and is not supported for any other purpose. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + + Support: Core type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. type: string ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. type: object properties: class: - description: This field configures the annotation `kubernetes.io/ingress.class` when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. type: string ingressClassName: - description: This field configures the field `ingressClassName` on the created Ingress resources used to solve ACME challenges that use this challenge solver. This is the recommended way of configuring the ingress class. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. type: string ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. type: object properties: metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. type: object properties: annotations: @@ -1857,14 +3275,26 @@ spec: additionalProperties: type: string name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. type: string podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. type: object properties: metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. type: object properties: annotations: @@ -1878,7 +3308,10 @@ spec: additionalProperties: type: string spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. type: object properties: affinity: @@ -1890,10 +3323,21 @@ spec: type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. type: array items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). type: object required: - preference @@ -1907,7 +3351,9 @@ spec: description: A list of node selector requirements by node's labels. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -1917,18 +3363,29 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -1938,20 +3395,35 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. type: object required: - nodeSelectorTerms @@ -1960,14 +3432,19 @@ spec: description: Required. A list of node selector terms. The terms are ORed. type: array items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -1977,18 +3454,29 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -1998,21 +3486,40 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -2028,14 +3535,18 @@ spec: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2045,40 +3556,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2088,49 +3635,90 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. type: array items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running type: object required: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2140,40 +3728,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2183,33 +3807,64 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string + x-kubernetes-list-type: atomic podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -2225,14 +3880,18 @@ spec: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2242,40 +3901,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2285,49 +3980,90 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. type: array items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running type: object required: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2337,40 +4073,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -2380,40 +4152,75 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string + x-kubernetes-list-type: atomic imagePullSecrets: description: If specified, the pod's imagePullSecrets type: array items: - description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. type: object properties: name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + TODO: Add other useful fields. apiVersion, kind, uid? + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896. type: string + default: "" x-kubernetes-map-type: atomic nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object additionalProperties: type: string @@ -2427,76 +4234,141 @@ spec: description: If specified, the pod's tolerations. type: array items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . type: object properties: effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. type: integer format: int64 value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. type: string selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. type: object properties: dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. type: array items: type: string dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. type: array items: type: string matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. type: object additionalProperties: type: string token: - description: The ACME challenge token for this challenge. This is the raw value returned from the ACME server. + description: |- + The ACME challenge token for this challenge. + This is the raw value returned from the ACME server. type: string type: - description: The type of ACME challenge this resource represents. One of "HTTP-01" or "DNS-01". + description: |- + The type of ACME challenge this resource represents. + One of "HTTP-01" or "DNS-01". type: string enum: - HTTP-01 - DNS-01 url: - description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. + description: |- + The URL of the ACME Challenge resource for this challenge. + This can be used to lookup details about the status of this challenge. type: string wildcard: - description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. + description: |- + wildcard will be true if this challenge is for a wildcard identifier, + for example '*.example.com'. type: boolean status: type: object properties: presented: - description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). + description: |- + presented will be set to true if the challenge values for this challenge + are currently 'presented'. + This *does not* imply the self check is passing. Only that the values + have been 'submitted' for the appropriate challenge mechanism (i.e. the + DNS01 TXT record has been presented, or the HTTP01 configuration has been + configured). type: boolean processing: - description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. + description: |- + Used to denote whether this challenge should be processed or not. + This field will only be set to true by the 'scheduling' component. + It will only be set to false by the 'challenges' controller, after the + challenge has reached a final state or timed out. + If this field is set to false, the challenge controller will not take + any more action. type: boolean reason: - description: Contains human readable information on why the Challenge is in the current state. + description: |- + Contains human readable information on why the Challenge is in the + current state. type: string state: - description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. + description: |- + Contains the current 'state' of the challenge. + If not set, the state of the challenge is unknown. type: string enum: - valid @@ -2565,45 +4437,91 @@ spec: type: date schema: openAPIV3Schema: - description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `Ready` status condition and its `status.failureTime` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." + description: |- + A CertificateRequest is used to request a signed certificate from one of the + configured issuers. + + + All fields within the CertificateRequest's `spec` are immutable after creation. + A CertificateRequest will either succeed or fail, as denoted by its `Ready` status + condition and its `status.failureTime` field. + + + A CertificateRequest is a one-shot resource, meaning it represents a single + point in time request for a certificate and cannot be re-used. type: object properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: - description: Specification of the desired state of the CertificateRequest resource. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + description: |- + Specification of the desired state of the CertificateRequest resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status type: object required: - issuerRef - request properties: duration: - description: Requested 'duration' (i.e. lifetime) of the Certificate. Note that the issuer may choose to ignore the requested duration, just like any other requested attribute. + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. type: string extra: - description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + description: |- + Extra contains extra attributes of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. type: object additionalProperties: type: array items: type: string groups: - description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + description: |- + Groups contains group membership of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. type: array items: type: string x-kubernetes-list-type: atomic isCA: - description: "Requested basic constraints isCA value. Note that the issuer may choose to ignore the requested isCA value, just like any other requested attribute. \n NOTE: If the CSR in the `Request` field has a BasicConstraints extension, it must have the same isCA value as specified here. \n If true, this will automatically add the `cert sign` usage to the list of requested `usages`." + description: |- + Requested basic constraints isCA value. Note that the issuer may choose + to ignore the requested isCA value, just like any other requested attribute. + + + NOTE: If the CSR in the `Request` field has a BasicConstraints extension, + it must have the same isCA value as specified here. + + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. type: boolean issuerRef: - description: "Reference to the issuer responsible for issuing the certificate. If the issuer is namespace-scoped, it must be in the same namespace as the Certificate. If the issuer is cluster-scoped, it can be used from any namespace. \n The `name` field of the reference must always be specified." + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + + The `name` field of the reference must always be specified. type: object required: - name @@ -2618,17 +4536,69 @@ spec: description: Name of the resource being referred to. type: string request: - description: "The PEM-encoded X.509 certificate signing request to be submitted to the issuer for signing. \n If the CSR has a BasicConstraints extension, its isCA attribute must match the `isCA` value of this CertificateRequest. If the CSR has a KeyUsage extension, its key usages must match the key usages in the `usages` field of this CertificateRequest. If the CSR has a ExtKeyUsage extension, its extended key usages must match the extended key usages in the `usages` field of this CertificateRequest." + description: |- + The PEM-encoded X.509 certificate signing request to be submitted to the + issuer for signing. + + + If the CSR has a BasicConstraints extension, its isCA attribute must + match the `isCA` value of this CertificateRequest. + If the CSR has a KeyUsage extension, its key usages must match the + key usages in the `usages` field of this CertificateRequest. + If the CSR has a ExtKeyUsage extension, its extended key usages + must match the extended key usages in the `usages` field of this + CertificateRequest. type: string format: byte uid: - description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + description: |- + UID contains the uid of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. type: string usages: - description: "Requested key usages and extended key usages. \n NOTE: If the CSR in the `Request` field has uses the KeyUsage or ExtKeyUsage extension, these extensions must have the same values as specified here without any additional values. \n If unset, defaults to `digital signature` and `key encipherment`." + description: |- + Requested key usages and extended key usages. + + + NOTE: If the CSR in the `Request` field has uses the KeyUsage or + ExtKeyUsage extension, these extensions must have the same values + as specified here without any additional values. + + + If unset, defaults to `digital signature` and `key encipherment`. type: array items: - description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"" + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" type: string enum: - signing @@ -2655,22 +4625,39 @@ spec: - microsoft sgc - netscape sgc username: - description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. + description: |- + Username contains the name of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. type: string status: - description: 'Status of the CertificateRequest. This is set and managed automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + description: |- + Status of the CertificateRequest. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status type: object properties: ca: - description: The PEM encoded X.509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. + description: |- + The PEM encoded X.509 certificate of the signer, also known as the CA + (Certificate Authority). + This is set on a best-effort basis by different issuers. + If not set, the CA is assumed to be unknown/not available. type: string format: byte certificate: - description: The PEM encoded X.509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. + description: |- + The PEM encoded X.509 certificate resulting from the certificate + signing request. + If not set, the CertificateRequest has either not been completed or has + failed. More information on failure can be found by checking the + `conditions` field. type: string format: byte conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. type: array items: description: CertificateRequestCondition contains condition information for a CertificateRequest. @@ -2680,14 +4667,20 @@ spec: - type properties: lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. type: string format: date-time message: - description: Message is a human readable description of the details of the last transition, complementing reason. + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. type: string reason: - description: Reason is a brief machine readable explanation for the condition's last transition. + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). @@ -2697,13 +4690,17 @@ spec: - "False" - Unknown type: - description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). + description: |- + Type of the condition, known values are (`Ready`, `InvalidRequest`, + `Approved`, `Denied`). type: string x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map failureTime: - description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. + description: |- + FailureTime stores the time that this CertificateRequest failed. This is + used to influence garbage collection and back-off. type: string format: date-time served: true @@ -2748,16 +4745,29 @@ spec: type: date schema: openAPIV3Schema: - description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. + description: |- + An Issuer represents a certificate issuing authority which can be + referenced as part of `issuerRef` fields. + It is scoped to a single namespace and can therefore only be referenced by + resources within the same namespace. type: object required: - spec properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -2766,34 +4776,65 @@ spec: type: object properties: acme: - description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + description: |- + ACME configures this issuer to communicate with a RFC8555 (ACME) server + to obtain signed x509 certificates. type: object required: - privateKeySecretRef - server properties: caBundle: - description: Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. + description: |- + Base64-encoded bundle of PEM CAs which can be used to validate the certificate + chain presented by the ACME server. + Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various + kinds of security vulnerabilities. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. type: string format: byte disableAccountKeyGeneration: - description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. + description: |- + Enables or disables generating a new ACME account key. + If true, the Issuer resource will *not* request a new account but will expect + the account key to be supplied via an existing secret. + If false, the cert-manager system will generate a new ACME account key + for the Issuer. + Defaults to false. type: boolean email: - description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. + description: |- + Email is the email address to be associated with the ACME account. + This field is optional, but it is strongly recommended to be set. + It will be used to contact you in case of issues with your account or + certificates, including expiry notification emails. + This field may be updated after the account is initially registered. type: string enableDurationFeature: - description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. + description: |- + Enables requesting a Not After date on certificates that matches the + duration of the certificate. This is not supported by all ACME servers + like Let's Encrypt. If set to true when the ACME server does not support + it, it will create an error on the Order. + Defaults to false. type: boolean externalAccountBinding: - description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + description: |- + ExternalAccountBinding is a reference to a CA external account of the ACME + server. + If set, upon registration cert-manager will attempt to associate the given + external account credentials with the registered ACME account. type: object required: - keyID - keySecretRef properties: keyAlgorithm: - description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' + description: |- + Deprecated: keyAlgorithm field exists for historical compatibility + reasons and should not be used. The algorithm is now hardcoded to HS256 + in golang/x/crypto/acme. type: string enum: - HS256 @@ -2803,68 +4844,130 @@ spec: description: keyID is the ID of the CA key that the External Account is bound to. type: string keySecretRef: - description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + description: |- + keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes + Secret which holds the symmetric MAC key of the External Account Binding. + The `key` is the index string that is paired with the key data in the + Secret and should not be confused with the key data itself, or indeed with + the External Account Binding keyID above. + The secret key stored in the Secret **must** be un-padded, base64 URL + encoded data. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string preferredChain: - description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' + description: |- + PreferredChain is the chain to use if the ACME server outputs multiple. + PreferredChain is no guarantee that this one gets delivered by the ACME + endpoint. + For example, for Let's Encrypt's DST crosssign you would use: + "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. + This value picks the first certificate bundle in the combined set of + ACME default and alternative chains that has a root-most certificate with + this value as its issuer's commonname. type: string maxLength: 64 privateKeySecretRef: - description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + description: |- + PrivateKey is the name of a Kubernetes Secret resource that will be used to + store the automatically generated ACME account private key. + Optionally, a `key` may be specified to select a specific entry within + the named Secret resource. + If `key` is not specified, a default of `tls.key` will be used. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string server: - description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' + description: |- + Server is the URL used to access the ACME server's 'directory' endpoint. + For example, for Let's Encrypt's staging endpoint, you would use: + "https://acme-staging-v02.api.letsencrypt.org/directory". + Only ACME v2 endpoints (i.e. RFC 8555) are supported. type: string skipTLSVerify: - description: 'INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.' + description: |- + INSECURE: Enables or disables validation of the ACME server TLS certificate. + If true, requests to the ACME server will not have the TLS certificate chain + validated. + Mutually exclusive with CABundle; prefer using CABundle to prevent various + kinds of security vulnerabilities. + Only enable this option in development environments. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + Defaults to false. type: boolean solvers: - description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' + description: |- + Solvers is a list of challenge solvers that will be used to solve + ACME challenges for the matching domains. + Solver configurations must be provided in order to obtain certificates + from an ACME server. + For more information, see: https://cert-manager.io/docs/configuration/acme/ type: array items: - description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. + description: |- + An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. + A selector may be provided to use different solving strategies for different DNS names. + Only one of HTTP01 or DNS01 must be provided. type: object properties: dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. type: object properties: acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. type: object required: - accountSecretRef - host properties: accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string host: type: string @@ -2878,40 +4981,61 @@ spec: - serviceConsumerDomain properties: accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string serviceConsumerDomain: type: string @@ -2923,19 +5047,30 @@ spec: - subscriptionID properties: clientID: - description: 'Auth: Azure Service Principal: The ClientID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientSecret and TenantID must also be set.' + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. type: string clientSecretSecretRef: - description: 'Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set.' + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string environment: description: name of the Azure environment (default AzurePublicCloud) @@ -2949,14 +5084,19 @@ spec: description: name of the DNS zone that should be used type: string managedIdentity: - description: 'Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.' + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. type: object properties: clientID: description: client ID of the managed identity, can not be used at the same time as resourceID type: string resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity type: string resourceGroupName: description: resource group the DNS zone is located in @@ -2965,7 +5105,10 @@ spec: description: ID of the Azure subscription type: string tenantID: - description: 'Auth: Azure Service Principal: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set.' + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. type: string cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. @@ -2974,37 +5117,55 @@ spec: - project properties: hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. type: string project: type: string serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. type: object properties: apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string apiTokenSecretRef: description: API token used to authenticate with Cloudflare. @@ -3013,16 +5174,23 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string email: description: Email of the account, only required when using API key based authentication. type: string cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. type: string enum: - None @@ -3034,43 +5202,69 @@ spec: - tokenSecretRef properties: tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. type: object required: - nameserver properties: nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. type: string tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. type: string tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. type: string tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string route53: description: Use the AWS Route53 API to manage DNS01 challenge records. @@ -3079,20 +5273,71 @@ spec: - region properties: accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. type: string @@ -3100,113 +5345,301 @@ spec: description: Always set the region when using AccessKeyID and SecretAccessKey type: string role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata type: string secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. type: object required: - groupName - solverName properties: config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. x-kubernetes-preserve-unknown-fields: true groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. type: string solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. type: string http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. type: object properties: gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. type: object properties: labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. type: object additionalProperties: type: string parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways type: array items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). There are two kinds of parent resources with \"Core\" support: \n * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, experimental, ClusterIP Services only) \n This API may be extended in the future to support additional kinds of parent resources. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + + This API may be extended in the future to support additional kinds of parent + resources. + + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. type: object required: - name properties: group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + + Support: Core type: string default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ kind: - description: "Kind is kind of the referent. \n There are two kinds of parent resources with \"Core\" support: \n * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, experimental, ClusterIP Services only) \n Support for other resources is Implementation-Specific." + description: |- + Kind is kind of the referent. + + + There are two kinds of parent resources with "Core" support: + + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + + Support for other resources is Implementation-Specific. type: string default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ name: - description: "Name is the name of the referent. \n Support: Core" + description: |- + Name is the name of the referent. + + + Support: Core type: string maxLength: 253 minLength: 1 namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. \n Support: Core" + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + + Support: Core type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + + Support: Extended type: integer format: int32 maximum: 65535 minimum: 1 sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. * Service: Port Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. Note that attaching Routes to Services as Parents is part of experimental Mesh support and is not supported for any other purpose. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + + Support: Core type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. type: string ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. type: object properties: class: - description: This field configures the annotation `kubernetes.io/ingress.class` when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. type: string ingressClassName: - description: This field configures the field `ingressClassName` on the created Ingress resources used to solve ACME challenges that use this challenge solver. This is the recommended way of configuring the ingress class. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. type: string ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. type: object properties: metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. type: object properties: annotations: @@ -3220,14 +5653,26 @@ spec: additionalProperties: type: string name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. Only one of `class`, `name` or `ingressClassName` may be specified. + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. type: string podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. type: object properties: metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. type: object properties: annotations: @@ -3241,7 +5686,10 @@ spec: additionalProperties: type: string spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. type: object properties: affinity: @@ -3253,10 +5701,21 @@ spec: type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. type: array items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). type: object required: - preference @@ -3270,7 +5729,9 @@ spec: description: A list of node selector requirements by node's labels. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -3280,18 +5741,29 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -3301,20 +5773,35 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. type: object required: - nodeSelectorTerms @@ -3323,14 +5810,19 @@ spec: description: Required. A list of node selector terms. The terms are ORed. type: array items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -3340,18 +5832,29 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. type: array items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. type: object required: - key @@ -3361,21 +5864,40 @@ spec: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic x-kubernetes-map-type: atomic podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -3391,14 +5913,18 @@ spec: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3408,40 +5934,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3451,49 +6013,90 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. type: array items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running type: object required: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3503,40 +6106,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3546,33 +6185,64 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string + x-kubernetes-list-type: atomic podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). type: object properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) @@ -3588,14 +6258,18 @@ spec: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3605,40 +6279,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3648,49 +6358,90 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. type: integer format: int32 + x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. type: array items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running type: object required: - topologyKey properties: labelSelector: - description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3700,40 +6451,76 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic mismatchLabelKeys: - description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. type: array items: type: string x-kubernetes-list-type: atomic namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. type: array items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. type: object required: - key @@ -3743,40 +6530,75 @@ spec: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. type: array items: type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object additionalProperties: type: string x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". type: array items: type: string + x-kubernetes-list-type: atomic topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string + x-kubernetes-list-type: atomic imagePullSecrets: description: If specified, the pod's imagePullSecrets type: array items: - description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. type: object properties: name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + TODO: Add other useful fields. apiVersion, kind, uid? + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896. type: string + default: "" x-kubernetes-map-type: atomic nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object additionalProperties: type: string @@ -3790,82 +6612,146 @@ spec: description: If specified, the pod's tolerations. type: array items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . type: object properties: effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. type: integer format: int64 value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. type: string selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. type: object properties: dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. type: array items: type: string dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. type: array items: type: string matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. type: object additionalProperties: type: string ca: - description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + description: |- + CA configures this issuer to sign certificates using a signing CA keypair + stored in a Secret resource. + This is used to build internal PKIs that are managed by cert-manager. type: object required: - secretName properties: crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set, certificates will be issued without distribution points set. type: array items: type: string issuingCertificateURLs: - description: IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be "http://ca.domain.com/ca.crt". + description: |- + IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates + it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. + As an example, such a URL might be "http://ca.domain.com/ca.crt". type: array items: type: string ocspServers: - description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + description: |- + The OCSP server list is an X.509 v3 extension that defines a list of + URLs of OCSP responders. The OCSP responders can be queried for the + revocation status of an issued certificate. If not set, the + certificate will be issued with no OCSP servers set. For example, an + OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". type: array items: type: string secretName: - description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. + description: |- + SecretName is the name of the secret used to sign Certificates issued + by this Issuer. type: string selfSigned: - description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + description: |- + SelfSigned configures this issuer to 'self sign' certificates using the + private key used to create the CertificateRequest object. type: object properties: crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set certificate will be issued without CDP. Values are strings. type: array items: type: string vault: - description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + description: |- + Vault configures this issuer to sign certificates using a HashiCorp Vault + PKI backend. type: object required: - auth @@ -3877,7 +6763,9 @@ spec: type: object properties: appRole: - description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. type: object required: - path @@ -3885,53 +6773,94 @@ spec: - secretRef properties: path: - description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' + description: |- + Path where the App Role authentication backend is mounted in Vault, e.g: + "approle" type: string roleId: - description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. type: string secretRef: - description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string kubernetes: - description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. type: object required: - role properties: mountPath: - description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/kubernetes" will be used. type: string role: - description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. type: string secretRef: - description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + description: |- + The required Secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. Use of 'ambient credentials' is not + supported. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string serviceAccountRef: - description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). Compared to using "secretRef", + using this field means that you don't rely on statically bound tokens. To + use this field, you must configure an RBAC rule to let cert-manager + request a token. type: object required: - name properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token + consisting of the issuer's namespace and name is always included. + type: array + items: + type: string name: description: Name of the ServiceAccount used to request a token. type: string @@ -3942,44 +6871,112 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by Vault. Only used if using HTTPS to connect to Vault and ignored for HTTP connections. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by Vault. Only used if using HTTPS to connect to Vault and + ignored for HTTP connections. + Mutually exclusive with CABundleSecretRef. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. type: string format: byte caBundleSecretRef: - description: Reference to a Secret containing a bundle of PEM-encoded CAs to use when verifying the certificate chain presented by Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + description: |- + Reference to a Secret containing a bundle of PEM-encoded CAs to use when + verifying the certificate chain presented by Vault when using HTTPS. + Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + If no key for the Secret is specified, cert-manager will default to 'ca.crt'. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientCertSecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Certificate to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientKeySecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Private Key to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string namespace: - description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces type: string path: - description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' + description: |- + Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: + "my_pki_mount/sign/my-role-name". type: string server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string venafi: - description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. + description: |- + Venafi configures this issuer to sign certificates using a Venafi TPP + or Venafi Cloud policy zone. type: object required: - zone properties: cloud: - description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. + description: |- + Cloud specifies the Venafi cloud configuration settings. + Only one of TPP or Cloud may be specified. type: object required: - apiTokenSecretRef @@ -3991,59 +6988,96 @@ spec: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string url: - description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". + description: |- + URL is the base URL for Venafi Cloud. + Defaults to "https://api.venafi.cloud/v1". type: string tpp: - description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. + description: |- + TPP specifies Trust Protection Platform configuration settings. + Only one of TPP or Cloud may be specified. type: object required: - credentialsRef - url properties: caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + If undefined, the certificate bundle in the cert-manager controller container + is used to validate the chain. type: string format: byte credentialsRef: - description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. + description: |- + CredentialsRef is a reference to a Secret containing the username and + password for the TPP server. + The secret must contain two keys, 'username' and 'password'. type: object required: - name properties: name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string url: - description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' + description: |- + URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + for example: "https://tpp.example.com/vedsdk". type: string zone: - description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. + description: |- + Zone is the Venafi Policy Zone to use for this issuer. + All requests made to the Venafi platform will be restricted by the named + zone policy. + This field is required. type: string status: description: Status of the Issuer. This is set and managed automatically. type: object properties: acme: - description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. type: object properties: lastPrivateKeyHash: - description: LastPrivateKeyHash is a hash of the private key associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer type: string lastRegisteredEmail: - description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer type: string uri: - description: URI is the unique account identifier, which can also be used to retrieve account details from the CA + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA type: string conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. type: array items: description: IssuerCondition contains condition information for an Issuer. @@ -4053,18 +7087,29 @@ spec: - type properties: lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. type: string format: date-time message: - description: Message is a human readable description of the details of the last transition, complementing reason. + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. type: string observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. type: integer format: int64 reason: - description: Reason is a brief machine readable explanation for the condition's last transition. + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). @@ -4131,41 +7176,77 @@ spec: type: date schema: openAPIV3Schema: - description: "A Certificate resource should be created to ensure an up to date and signed X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." + description: |- + A Certificate resource should be created to ensure an up to date and signed + X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. + + + The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). type: object properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: - description: Specification of the desired state of the Certificate resource. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + description: |- + Specification of the desired state of the Certificate resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status type: object required: - issuerRef - secretName properties: additionalOutputFormats: - description: "Defines extra output formats of the private key and signed certificate chain to be written to this Certificate's target Secret. \n This is an Alpha Feature and is only enabled with the `--feature-gates=AdditionalCertificateOutputFormats=true` option set on both the controller and webhook components." + description: |- + Defines extra output formats of the private key and signed certificate chain + to be written to this Certificate's target Secret. + + + This is a Beta Feature enabled by default. It can be disabled with the + `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both + the controller and webhook components. type: array items: - description: CertificateAdditionalOutputFormat defines an additional output format of a Certificate resource. These contain supplementary data formats of the signed certificate chain and paired private key. + description: |- + CertificateAdditionalOutputFormat defines an additional output format of a + Certificate resource. These contain supplementary data formats of the signed + certificate chain and paired private key. type: object required: - type properties: type: - description: Type is the name of the format type that should be written to the Certificate's target Secret. + description: |- + Type is the name of the format type that should be written to the + Certificate's target Secret. type: string enum: - DER - CombinedPEM commonName: - description: "Requested common name X509 certificate subject attribute. More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 NOTE: TLS clients will ignore this value when any subject alternative name is set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). \n Should have a length of 64 characters or fewer to avoid generating invalid CSRs. Cannot be set if the `literalSubject` field is set." + description: |- + Requested common name X509 certificate subject attribute. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + NOTE: TLS clients will ignore this value when any subject alternative name is + set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). + + + Should have a length of 64 characters or fewer to avoid generating invalid CSRs. + Cannot be set if the `literalSubject` field is set. type: string dnsNames: description: Requested DNS subject alternative names. @@ -4173,7 +7254,15 @@ spec: items: type: string duration: - description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the issuer may choose to ignore the requested duration, just like any other requested attribute. \n If unset, this defaults to 90 days. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration." + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + + + If unset, this defaults to 90 days. + Minimum accepted duration is 1 hour. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. type: string emailAddresses: description: Requested email subject alternative names. @@ -4181,7 +7270,12 @@ spec: items: type: string encodeUsagesInRequest: - description: "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. \n This option defaults to true, and should only be disabled if the target issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions." + description: |- + Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. + + + This option defaults to true, and should only be disabled if the target + issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. type: boolean ipAddresses: description: Requested IP address subject alternative names. @@ -4189,10 +7283,25 @@ spec: items: type: string isCA: - description: "Requested basic constraints isCA value. The isCA value is used to set the `isCA` field on the created CertificateRequest resources. Note that the issuer may choose to ignore the requested isCA value, just like any other requested attribute. \n If true, this will automatically add the `cert sign` usage to the list of requested `usages`." + description: |- + Requested basic constraints isCA value. + The isCA value is used to set the `isCA` field on the created CertificateRequest + resources. Note that the issuer may choose to ignore the requested isCA value, just + like any other requested attribute. + + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. type: boolean issuerRef: - description: "Reference to the issuer responsible for issuing the certificate. If the issuer is namespace-scoped, it must be in the same namespace as the Certificate. If the issuer is cluster-scoped, it can be used from any namespace. \n The `name` field of the reference must always be specified." + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + + The `name` field of the reference must always be specified. type: object required: - name @@ -4211,68 +7320,140 @@ spec: type: object properties: jks: - description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. + description: |- + JKS configures options for storing a JKS keystore in the + `spec.secretName` Secret resource. type: object required: - create - passwordSecretRef properties: + alias: + description: |- + Alias specifies the alias of the key in the keystore, required by the JKS format. + If not provided, the default alias `certificate` will be used. + type: string create: - description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named `truststore.jks` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority + description: |- + Create enables JKS keystore creation for the Certificate. + If true, a file named `keystore.jks` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.jks` + will also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` + containing the issuing Certificate Authority type: boolean passwordSecretRef: - description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. + description: |- + PasswordSecretRef is a reference to a key in a Secret resource + containing the password used to encrypt the JKS keystore. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string pkcs12: - description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. + description: |- + PKCS12 configures options for storing a PKCS12 keystore in the + `spec.secretName` Secret resource. type: object required: - create - passwordSecretRef properties: create: - description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named `truststore.p12` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority + description: |- + Create enables PKCS12 keystore creation for the Certificate. + If true, a file named `keystore.p12` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.p12` will + also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` containing the issuing Certificate + Authority type: boolean passwordSecretRef: - description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. + description: |- + PasswordSecretRef is a reference to a key in a Secret resource + containing the password used to encrypt the PKCS12 keystore. type: object required: - name properties: key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string profile: - description: "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. \n If provided, allowed values are: `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms (eg. because of company policy). Please note that the security of the algorithm is not that important in reality, because the unencrypted certificate and private key are also stored in the Secret." + description: |- + Profile specifies the key and certificate encryption algorithms and the HMAC algorithm + used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. + + + If provided, allowed values are: + `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. + `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. + `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms + (eg. because of company policy). Please note that the security of the algorithm is not that important + in reality, because the unencrypted certificate and private key are also stored in the Secret. type: string enum: - LegacyRC2 - LegacyDES - Modern2023 literalSubject: - description: "Requested X.509 certificate subject, represented using the LDAP \"String Representation of a Distinguished Name\" [1]. Important: the LDAP string format also specifies the order of the attributes in the subject, this is important when issuing certs for LDAP authentication. Example: `CN=foo,DC=corp,DC=example,DC=com` More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 More info: https://github.com/cert-manager/cert-manager/issues/3203 More info: https://github.com/cert-manager/cert-manager/issues/4424 \n Cannot be set if the `subject` or `commonName` field is set. This is an Alpha Feature and is only enabled with the `--feature-gates=LiteralCertificateSubject=true` option set on both the controller and webhook components." + description: |- + Requested X.509 certificate subject, represented using the LDAP "String + Representation of a Distinguished Name" [1]. + Important: the LDAP string format also specifies the order of the attributes + in the subject, this is important when issuing certs for LDAP authentication. + Example: `CN=foo,DC=corp,DC=example,DC=com` + More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 + More info: https://github.com/cert-manager/cert-manager/issues/3203 + More info: https://github.com/cert-manager/cert-manager/issues/4424 + + + Cannot be set if the `subject` or `commonName` field is set. type: string nameConstraints: - description: "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 \n This is an Alpha Feature and is only enabled with the `--feature-gates=NameConstraints=true` option set on both the controller and webhook components." + description: |- + x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. + More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 + + + This is an Alpha Feature and is only enabled with the + `--feature-gates=NameConstraints=true` option set on both + the controller and webhook components. type: object properties: critical: description: if true then the name constraints are marked critical. type: boolean excluded: - description: Excluded contains the constraints which must be disallowed. Any name matching a restriction in the excluded field is invalid regardless of information appearing in the permitted + description: |- + Excluded contains the constraints which must be disallowed. Any name matching a + restriction in the excluded field is invalid regardless + of information appearing in the permitted type: object properties: dnsDomains: @@ -4286,7 +7467,9 @@ spec: items: type: string ipRanges: - description: IPRanges is a list of IP Ranges that are permitted or excluded. This should be a valid CIDR notation. + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. type: array items: type: string @@ -4310,7 +7493,9 @@ spec: items: type: string ipRanges: - description: IPRanges is a list of IP Ranges that are permitted or excluded. This should be a valid CIDR notation. + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. type: array items: type: string @@ -4320,55 +7505,136 @@ spec: items: type: string otherNames: - description: '`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.' + description: |- + `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 + Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. + Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 + You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. type: array items: type: object properties: oid: - description: OID is the object identifier for the otherName SAN. The object identifier must be expressed as a dotted string, for example, "1.2.840.113556.1.4.221". + description: |- + OID is the object identifier for the otherName SAN. + The object identifier must be expressed as a dotted string, for + example, "1.2.840.113556.1.4.221". type: string utf8Value: - description: utf8Value is the string value of the otherName SAN. The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. + description: |- + utf8Value is the string value of the otherName SAN. + The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. type: string privateKey: - description: Private key options. These include the key algorithm and size, the used encoding and the rotation policy. + description: |- + Private key options. These include the key algorithm and size, the used + encoding and the rotation policy. type: object properties: algorithm: - description: "Algorithm is the private key algorithm of the corresponding private key for this certificate. \n If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. If `algorithm` is specified and `size` is not provided, key size of 2048 will be used for `RSA` key algorithm and key size of 256 will be used for `ECDSA` key algorithm. key size is ignored when using the `Ed25519` key algorithm." + description: |- + Algorithm is the private key algorithm of the corresponding private key + for this certificate. + + + If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. + If `algorithm` is specified and `size` is not provided, + key size of 2048 will be used for `RSA` key algorithm and + key size of 256 will be used for `ECDSA` key algorithm. + key size is ignored when using the `Ed25519` key algorithm. type: string enum: - RSA - ECDSA - Ed25519 encoding: - description: "The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. \n If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and PKCS#8, respectively. Defaults to `PKCS1` if not specified." + description: |- + The private key cryptography standards (PKCS) encoding for this + certificate's private key to be encoded in. + + + If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 + and PKCS#8, respectively. + Defaults to `PKCS1` if not specified. type: string enum: - PKCS1 - PKCS8 rotationPolicy: - description: "RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. \n If set to `Never`, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to `Always`, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is `Never` for backward compatibility." + description: |- + RotationPolicy controls how private keys should be regenerated when a + re-issuance is being processed. + + + If set to `Never`, a private key will only be generated if one does not + already exist in the target `spec.secretName`. If one does exists but it + does not have the correct algorithm or size, a warning will be raised + to await user intervention. + If set to `Always`, a private key matching the specified requirements + will be generated whenever a re-issuance occurs. + Default is `Never` for backward compatibility. type: string enum: - Never - Always size: - description: "Size is the key bit size of the corresponding private key for this certificate. \n If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed." + description: |- + Size is the key bit size of the corresponding private key for this certificate. + + + If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, + and will default to `2048` if not specified. + If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, + and will default to `256` if not specified. + If `algorithm` is set to `Ed25519`, Size is ignored. + No other values are allowed. type: integer renewBefore: - description: "How long before the currently issued certificate's expiry cert-manager should renew the certificate. For example, if a certificate is valid for 60 minutes, and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate 50 minutes after it was issued (i.e. when there are 10 minutes remaining until the certificate is no longer valid). \n NOTE: The actual lifetime of the issued certificate is used to determine the renewal time. If an issuer returns a certificate with a different lifetime than the one requested, cert-manager will use the lifetime of the issued certificate. \n If unset, this defaults to 1/3 of the issued certificate's lifetime. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration." + description: |- + How long before the currently issued certificate's expiry cert-manager should + renew the certificate. For example, if a certificate is valid for 60 minutes, + and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate + 50 minutes after it was issued (i.e. when there are 10 minutes remaining until + the certificate is no longer valid). + + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + + If unset, this defaults to 1/3 of the issued certificate's lifetime. + Minimum accepted value is 5 minutes. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. type: string revisionHistoryLimit: - description: "The maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. \n If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`." + description: |- + The maximum number of CertificateRequest revisions that are maintained in + the Certificate's history. Each revision represents a single `CertificateRequest` + created by this Certificate, either when it was created, renewed, or Spec + was changed. Revisions will be removed by oldest first if the number of + revisions exceeds this number. + + + If set, revisionHistoryLimit must be a value of `1` or greater. + If unset (`nil`), revisions will not be garbage collected. + Default value is `nil`. type: integer format: int32 secretName: - description: Name of the Secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. The Secret resource lives in the same namespace as the Certificate resource. + description: |- + Name of the Secret resource that will be automatically created and + managed by this Certificate resource. It will be populated with a + private key and certificate, signed by the denoted issuer. The Secret + resource lives in the same namespace as the Certificate resource. type: string secretTemplate: - description: Defines annotations and labels to be copied to the Certificate's Secret. Labels and annotations on the Secret will be changed as they appear on the SecretTemplate when added or removed. SecretTemplate annotations are added in conjunction with, and cannot overwrite, the base set of annotations cert-manager sets on the Certificate's Secret. + description: |- + Defines annotations and labels to be copied to the Certificate's Secret. + Labels and annotations on the Secret will be changed as they appear on the + SecretTemplate when added or removed. SecretTemplate annotations are added + in conjunction with, and cannot overwrite, the base set of annotations + cert-manager sets on the Certificate's Secret. type: object properties: annotations: @@ -4382,7 +7648,13 @@ spec: additionalProperties: type: string subject: - description: "Requested set of X509 certificate subject attributes. More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 \n The common name attribute is specified separately in the `commonName` field. Cannot be set if the `literalSubject` field is set." + description: |- + Requested set of X509 certificate subject attributes. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + + + The common name attribute is specified separately in the `commonName` field. + Cannot be set if the `literalSubject` field is set. type: object properties: countries: @@ -4429,10 +7701,47 @@ spec: items: type: string usages: - description: "Requested key usages and extended key usages. These usages are used to set the `usages` field on the created CertificateRequest resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages will additionally be encoded in the `request` field which contains the CSR blob. \n If unset, defaults to `digital signature` and `key encipherment`." + description: |- + Requested key usages and extended key usages. + These usages are used to set the `usages` field on the created CertificateRequest + resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages + will additionally be encoded in the `request` field which contains the CSR blob. + + + If unset, defaults to `digital signature` and `key encipherment`. type: array items: - description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"" + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" type: string enum: - signing @@ -4459,11 +7768,17 @@ spec: - microsoft sgc - netscape sgc status: - description: 'Status of the Certificate. This is set and managed automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + description: |- + Status of the Certificate. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status type: object properties: conditions: - description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. + description: |- + List of status conditions to indicate the status of certificates. + Known condition types are `Ready` and `Issuing`. type: array items: description: CertificateCondition contains condition information for an Certificate. @@ -4473,18 +7788,29 @@ spec: - type properties: lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. type: string format: date-time message: - description: Message is a human readable description of the details of the last transition, complementing reason. + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. type: string observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Certificate. type: integer format: int64 reason: - description: Reason is a brief machine readable explanation for the condition's last transition. + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). @@ -4500,29 +7826,69 @@ spec: - type x-kubernetes-list-type: map failedIssuanceAttempts: - description: The number of continuous failed issuance attempts up till now. This field gets removed (if set) on a successful issuance and gets set to 1 if unset and an issuance has failed. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1). + description: |- + The number of continuous failed issuance attempts up till now. This + field gets removed (if set) on a successful issuance and gets set to + 1 if unset and an issuance has failed. If an issuance has failed, the + delay till the next issuance will be calculated using formula + time.Hour * 2 ^ (failedIssuanceAttempts - 1). type: integer lastFailureTime: - description: LastFailureTime is set only if the lastest issuance for this Certificate failed and contains the time of the failure. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1). If the latest issuance has succeeded this field will be unset. + description: |- + LastFailureTime is set only if the lastest issuance for this + Certificate failed and contains the time of the failure. If an + issuance has failed, the delay till the next issuance will be + calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - + 1). If the latest issuance has succeeded this field will be unset. type: string format: date-time nextPrivateKeySecretName: - description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. + description: |- + The name of the Secret resource containing the private key to be used + for the next certificate iteration. + The keymanager controller will automatically set this field if the + `Issuing` condition is set to `True`. + It will automatically unset this field when the Issuing condition is + not set or False. type: string notAfter: - description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. + description: |- + The expiration time of the certificate stored in the secret named + by this resource in `spec.secretName`. type: string format: date-time notBefore: - description: The time after which the certificate stored in the secret named by this resource in `spec.secretName` is valid. + description: |- + The time after which the certificate stored in the secret named + by this resource in `spec.secretName` is valid. type: string format: date-time renewalTime: - description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. + description: |- + RenewalTime is the time at which the certificate will be next + renewed. + If not set, no upcoming renewal is scheduled. type: string format: date-time revision: - description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." + description: |- + The current 'revision' of the certificate as issued. + + + When a CertificateRequest resource is created, it will have the + `cert-manager.io/certificate-revision` set to one greater than the + current value of this field. + + + Upon issuance, this field will be set to the value of the annotation + on the CertificateRequest resource used to issue the certificate. + + + Persisting the value on the CertificateRequest resource allows the + certificates controller to know whether a request is part of an old + issuance or if it is part of the ongoing revision's issuance by + checking if the revision value in the annotation is greater than this + field. type: integer served: true storage: true @@ -4578,10 +7944,19 @@ spec: - spec properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -4592,23 +7967,39 @@ spec: - request properties: commonName: - description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. + description: |- + CommonName is the common name as specified on the DER encoded CSR. + If specified, this value must also be present in `dnsNames` or `ipAddresses`. + This field must match the corresponding field on the DER encoded CSR. type: string dnsNames: - description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + description: |- + DNSNames is a list of DNS names that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. type: array items: type: string duration: - description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. + description: |- + Duration is the duration for the not after date for the requested certificate. + this is set on order creation as pe the ACME spec. type: string ipAddresses: - description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. + description: |- + IPAddresses is a list of IP addresses that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. type: array items: type: string issuerRef: - description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. + description: |- + IssuerRef references a properly configured ACME-type Issuer which should + be used to create this Order. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Order will be marked as failed. type: object required: - name @@ -4623,26 +8014,42 @@ spec: description: Name of the resource being referred to. type: string request: - description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. + description: |- + Certificate signing request bytes in DER encoding. + This will be used when finalizing the order. + This field must be set on the order. type: string format: byte status: type: object properties: authorizations: - description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. + description: |- + Authorizations contains data returned from the ACME server on what + authorizations must be completed in order to validate the DNS names + specified on the Order. type: array items: - description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. + description: |- + ACMEAuthorization contains data returned from the ACME server on an + authorization that must be completed in order validate a DNS name on an ACME + Order resource. type: object required: - url properties: challenges: - description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. + description: |- + Challenges specifies the challenge types offered by the ACME server. + One of these challenge types will be selected when validating the DNS + name and an appropriate Challenge resource will be created to perform + the ACME challenge process. type: array items: - description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. + description: |- + Challenge specifies a challenge offered by the ACME server for an Order. + An appropriate Challenge resource can be created to perform the ACME + challenge process. type: object required: - token @@ -4650,19 +8057,36 @@ spec: - url properties: token: - description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. + description: |- + Token is the token that must be presented for this challenge. + This is used to compute the 'key' that must also be presented. type: string type: - description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. + description: |- + Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', + 'tls-sni-01', etc. + This is the raw value retrieved from the ACME server. + Only 'http-01' and 'dns-01' are supported by cert-manager, other values + will be ignored. type: string url: - description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. + description: |- + URL is the URL of this challenge. It can be used to retrieve additional + metadata about the Challenge from the ACME server. type: string identifier: description: Identifier is the DNS name to be validated as part of this authorization type: string initialState: - description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. + description: |- + InitialState is the initial state of the ACME authorization when first + fetched from the ACME server. + If an Authorization is already 'valid', the Order controller will not + create a Challenge resource for the authorization. This will occur when + working with an ACME server that enables 'authz reuse' (such as Let's + Encrypt's production endpoint). + If not set and 'identifier' is set, the state is assumed to be pending + and a Challenge will be created. type: string enum: - valid @@ -4676,24 +8100,41 @@ spec: description: URL is the URL of the Authorization that must be completed type: string wildcard: - description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. + description: |- + Wildcard will be true if this authorization is for a wildcard DNS name. + If this is true, the identifier will be the *non-wildcard* version of + the DNS name. + For example, if '*.example.com' is the DNS name being validated, this + field will be 'true' and the 'identifier' field will be 'example.com'. type: boolean certificate: - description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. + description: |- + Certificate is a copy of the PEM encoded certificate for this Order. + This field will be populated after the order has been successfully + finalized with the ACME server, and the order has transitioned to the + 'valid' state. type: string format: byte failureTime: - description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. + description: |- + FailureTime stores the time that this order failed. + This is used to influence garbage collection and back-off. type: string format: date-time finalizeURL: - description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. + description: |- + FinalizeURL of the Order. + This is used to obtain certificates for this order once it has been completed. type: string reason: - description: Reason optionally provides more information about a why the order is in the current state. + description: |- + Reason optionally provides more information about a why the order is in + the current state. type: string state: - description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' + description: |- + State contains the current state of this Order resource. + States 'success' and 'expired' are 'final' type: string enum: - valid @@ -4704,7 +8145,11 @@ spec: - expired - errored url: - description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. + description: |- + URL of the Order. + This will initially be empty when the resource is first created. + The Order controller will populate this field when the Order is first processed. + This field will be immutable after it is initially set. type: string served: true storage: true diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2 b/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2 index 2bbda11..a00d0ae 100644 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2 @@ -422,7 +422,9 @@ rules: - apiGroups: ["cert-manager.io"] resources: ["signers"] verbs: ["approve"] - resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"] + resourceNames: + - "issuers.cert-manager.io/*" + - "clusterissuers.cert-manager.io/*" --- # Source: cert-manager/deploy/charts/cert-manager/templates/rbac.yaml # Permission to: @@ -921,9 +923,7 @@ spec: capabilities: drop: - ALL - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + readOnlyRootFilesystem: true {% if cert_manager_tolerations %} tolerations: {{ cert_manager_tolerations | to_nice_yaml(indent=2) | indent(width=8) }} @@ -1009,9 +1009,7 @@ spec: capabilities: drop: - ALL - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + readOnlyRootFilesystem: true env: - name: POD_NAMESPACE valueFrom: @@ -1029,6 +1027,16 @@ spec: - name: NO_PROXY value: "{{ cert_manager_no_proxy }}" {% endif %} + livenessProbe: + httpGet: + port: http-healthz + path: /livez + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 15 + successThreshold: 1 + failureThreshold: 8 {% if cert_manager_trusted_internal_ca is defined %} volumeMounts: - mountPath: /etc/ssl/certs/internal-ca.pem @@ -1138,9 +1146,7 @@ spec: capabilities: drop: - ALL - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + readOnlyRootFilesystem: true env: - name: POD_NAMESPACE valueFrom: @@ -1189,20 +1195,18 @@ webhooks: rules: - apiGroups: - "cert-manager.io" - - "acme.cert-manager.io" apiVersions: - "v1" operations: - CREATE - - UPDATE resources: - - "*/*" + - "certificaterequests" admissionReviewVersions: ["v1"] # This webhook only accepts v1 cert-manager resources. # Equivalent matchPolicy ensures that non-v1 resource requests are sent to # this webhook (after the resources have been converted to v1). matchPolicy: Equivalent - timeoutSeconds: 10 + timeoutSeconds: 30 failurePolicy: Fail # Only include 'sideEffects' field in Kubernetes 1.12+ sideEffects: None @@ -1229,8 +1233,8 @@ webhooks: - name: webhook.cert-manager.io namespaceSelector: matchExpressions: - - key: "cert-manager.io/disable-validation" - operator: "NotIn" + - key: cert-manager.io/disable-validation + operator: NotIn values: - "true" rules: @@ -1249,7 +1253,7 @@ webhooks: # Equivalent matchPolicy ensures that non-v1 resource requests are sent to # this webhook (after the resources have been converted to v1). matchPolicy: Equivalent - timeoutSeconds: 10 + timeoutSeconds: 30 failurePolicy: Fail sideEffects: None clientConfig: diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml index 8294302..b4f385c 100644 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml @@ -4,7 +4,9 @@ ingress_nginx_host_network: false ingress_nginx_service_type: LoadBalancer ingress_nginx_service_nodeport_http: "" ingress_nginx_service_nodeport_https: "" +ingress_nginx_service_annotations: {} ingress_publish_status_address: "" +ingress_nginx_publish_service: "{{ ingress_nginx_namespace }}/ingress-nginx" ingress_nginx_nodeselector: kubernetes.io/os: "linux" ingress_nginx_tolerations: [] diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2 b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2 index d6878a0..4ade5ef 100644 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2 @@ -13,6 +13,7 @@ webhooks: name: ingress-nginx-controller-admission namespace: {{ ingress_nginx_namespace }} path: /networking/v1/ingresses + port: 443 failurePolicy: Fail matchPolicy: Equivalent name: validate.nginx.ingress.kubernetes.io diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2 b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2 index c7657b6..5b11e54 100644 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2 @@ -30,15 +30,18 @@ spec: - /init_module image: {{ ingress_nginx_opentelemetry_image_repo }}:{{ ingress_nginx_opentelemetry_image_tag }} securityContext: - runAsNonRoot: true - runAsUser: 65532 allowPrivilegeEscalation: false + capabilities: + add: + - NET_BIND_SERVICE + drop: + - ALL + readOnlyRootFilesystem: false + runAsGroup: 82 + runAsNonRoot: true + runAsUser: 101 seccompProfile: type: RuntimeDefault - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true volumeMounts: - mountPath: /modules_mount name: modules @@ -76,11 +79,12 @@ spec: {% if ingress_nginx_without_class %} - --watch-ingress-without-class=true {% endif %} -{% if ingress_nginx_host_network %} - - --report-node-internal-ip-address -{% endif %} {% if ingress_publish_status_address != "" %} - --publish-status-address={{ ingress_publish_status_address }} +{% elif ingress_nginx_host_network %} + - --report-node-internal-ip-address +{% elif ingress_nginx_publish_service != "" %} + - --publish-service={{ ingress_nginx_publish_service }} {% endif %} {% for extra_arg in ingress_nginx_extra_args %} - {{ extra_arg }} @@ -122,6 +126,26 @@ spec: {% if not ingress_nginx_host_network %} hostPort: {{ ingress_nginx_metrics_port }} {% endif %} +{% if ingress_nginx_configmap_tcp_services %} +{% for port in ingress_nginx_configmap_tcp_services.keys() %} + - name: tcp-port-{{ port }} + containerPort: "{{ port | int }}" + protocol: TCP +{% if not ingress_nginx_host_network %} + hostPort: "{{ port | int }}" +{% endif %} +{% endfor %} +{% endif %} +{% if ingress_nginx_configmap_udp_services %} +{% for port in ingress_nginx_configmap_udp_services.keys() %} + - name: udp-port-{{ port }} + containerPort: "{{ port | int }}" + protocol: UDP +{% if not ingress_nginx_host_network %} + hostPort: "{{ port | int }}" +{% endif %} +{% endfor %} +{% endif %} {% if ingress_nginx_webhook_enabled %} - name: webhook containerPort: 8443 diff --git a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2 b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2 index 072b989..02f0b62 100644 --- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2 @@ -7,6 +7,10 @@ metadata: labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx +{% if ingress_nginx_service_annotations %} + annotations: + {{ ingress_nginx_service_annotations | to_nice_yaml(indent=2, width=1337) | indent(width=4) }} +{% endif %} spec: type: {{ ingress_nginx_service_type }} ports: @@ -23,6 +27,22 @@ spec: protocol: TCP {% if (ingress_nginx_service_type == 'NodePort' or ingress_nginx_service_type == 'LoadBalancer') and ingress_nginx_service_nodeport_https %} nodePort: {{ingress_nginx_service_nodeport_https | int}} +{% endif %} +{% if ingress_nginx_configmap_tcp_services %} +{% for port in ingress_nginx_configmap_tcp_services.keys() %} + - name: tcp-port-{{ port }} + port: "{{ port | int }}" + targetPort: "{{ port | int }}" + protocol: TCP +{% endfor %} +{% endif %} +{% if ingress_nginx_configmap_udp_services %} +{% for port in ingress_nginx_configmap_udp_services.keys() %} + - name: udp-port-{{ port }} + port: "{{ port | int }}" + targetPort: "{{ port | int }}" + protocol: UDP +{% endfor %} {% endif %} selector: app.kubernetes.io/name: ingress-nginx diff --git a/kubespray/project/roles/kubernetes-apps/krew/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/krew/defaults/main.yml deleted file mode 100644 index 6878427..0000000 --- a/kubespray/project/roles/kubernetes-apps/krew/defaults/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -krew_enabled: false -krew_root_dir: "/usr/local/krew" -krew_default_index_uri: https://github.com/kubernetes-sigs/krew-index.git -krew_no_upgrade_check: 0 diff --git a/kubespray/project/roles/kubernetes-apps/krew/tasks/krew.yml b/kubespray/project/roles/kubernetes-apps/krew/tasks/krew.yml deleted file mode 100644 index 3308aef..0000000 --- a/kubespray/project/roles/kubernetes-apps/krew/tasks/krew.yml +++ /dev/null @@ -1,38 +0,0 @@ ---- -- name: Krew | Download krew - include_tasks: "../../../download/tasks/download_file.yml" - vars: - download: "{{ download_defaults | combine(downloads.krew) }}" - -- name: Krew | krew env - template: - src: krew.j2 - dest: /etc/bash_completion.d/krew - mode: "0644" - -- name: Krew | Copy krew manifest - template: - src: krew.yml.j2 - dest: "{{ local_release_dir }}/krew.yml" - mode: "0644" - -- name: Krew | Install krew # noqa command-instead-of-shell - shell: "{{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }} install --archive={{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }}.tar.gz --manifest={{ local_release_dir }}/krew.yml" - environment: - KREW_ROOT: "{{ krew_root_dir }}" - KREW_DEFAULT_INDEX_URI: "{{ krew_default_index_uri | default('') }}" - -- name: Krew | Get krew completion - command: "{{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }} completion bash" - changed_when: false - register: krew_completion - check_mode: false - ignore_errors: true # noqa ignore-errors - -- name: Krew | Install krew completion - copy: - dest: /etc/bash_completion.d/krew.sh - content: "{{ krew_completion.stdout }}" - mode: "0755" - become: true - when: krew_completion.rc == 0 diff --git a/kubespray/project/roles/kubernetes-apps/krew/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/krew/tasks/main.yml deleted file mode 100644 index 40729e8..0000000 --- a/kubespray/project/roles/kubernetes-apps/krew/tasks/main.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -- name: Krew | install krew on kube_control_plane - import_tasks: krew.yml - -- name: Krew | install krew on localhost - import_tasks: krew.yml - delegate_to: localhost - connection: local - run_once: true - when: kubectl_localhost diff --git a/kubespray/project/roles/kubernetes-apps/krew/templates/krew.j2 b/kubespray/project/roles/kubernetes-apps/krew/templates/krew.j2 deleted file mode 100644 index 62a744c..0000000 --- a/kubespray/project/roles/kubernetes-apps/krew/templates/krew.j2 +++ /dev/null @@ -1,7 +0,0 @@ -# krew bash env(kubespray) -export KREW_ROOT="{{ krew_root_dir }}" -{% if krew_default_index_uri is defined %} -export KREW_DEFAULT_INDEX_URI='{{ krew_default_index_uri }}' -{% endif %} -export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH" -export KREW_NO_UPGRADE_CHECK={{ krew_no_upgrade_check }} diff --git a/kubespray/project/roles/kubernetes-apps/krew/templates/krew.yml.j2 b/kubespray/project/roles/kubernetes-apps/krew/templates/krew.yml.j2 deleted file mode 100644 index b0c6152..0000000 --- a/kubespray/project/roles/kubernetes-apps/krew/templates/krew.yml.j2 +++ /dev/null @@ -1,100 +0,0 @@ -apiVersion: krew.googlecontainertools.github.com/v1alpha2 -kind: Plugin -metadata: - name: krew -spec: - version: "{{ krew_version }}" - homepage: https://krew.sigs.k8s.io/ - shortDescription: Package manager for kubectl plugins. - caveats: | - krew is now installed! To start using kubectl plugins, you need to add - krew's installation directory to your PATH: - - * macOS/Linux: - - Add the following to your ~/.bashrc or ~/.zshrc: - export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH" - - Restart your shell. - - * Windows: Add %USERPROFILE%\.krew\bin to your PATH environment variable - - To list krew commands and to get help, run: - $ kubectl krew - For a full list of available plugins, run: - $ kubectl krew search - - You can find documentation at - https://krew.sigs.k8s.io/docs/user-guide/quickstart/. - - platforms: - - uri: {{ krew_download_url }} - sha256: {{ krew_archive_checksum }} - bin: krew - files: - - from: ./krew-darwin_amd64 - to: krew - - from: ./LICENSE - to: . - selector: - matchLabels: - os: darwin - arch: amd64 - - uri: {{ krew_download_url }} - sha256: {{ krew_archive_checksum }} - bin: krew - files: - - from: ./krew-darwin_arm64 - to: krew - - from: ./LICENSE - to: . - selector: - matchLabels: - os: darwin - arch: arm64 - - uri: {{ krew_download_url }} - sha256: {{ krew_archive_checksum }} - bin: krew - files: - - from: ./krew-linux_amd64 - to: krew - - from: ./LICENSE - to: . - selector: - matchLabels: - os: linux - arch: amd64 - - uri: {{ krew_download_url }} - sha256: {{ krew_archive_checksum }} - bin: krew - files: - - from: ./krew-linux_arm - to: krew - - from: ./LICENSE - to: . - selector: - matchLabels: - os: linux - arch: arm - - uri: {{ krew_download_url }} - sha256: {{ krew_archive_checksum }} - bin: krew - files: - - from: ./krew-linux_arm64 - to: krew - - from: ./LICENSE - to: . - selector: - matchLabels: - os: linux - arch: arm64 - - uri: {{ krew_download_url }} - sha256: {{ krew_archive_checksum }} - bin: krew.exe - files: - - from: ./krew-windows_amd64.exe - to: krew.exe - - from: ./LICENSE - to: . - selector: - matchLabels: - os: windows - arch: amd64 diff --git a/kubespray/project/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml b/kubespray/project/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml index 93d1383..56f7e71 100644 --- a/kubespray/project/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml +++ b/kubespray/project/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml @@ -13,7 +13,8 @@ dependencies: namespace: "{{ kubelet_csr_approver_namespace }}" chart_ref: "{{ kubelet_csr_approver_chart_ref }}" chart_version: "{{ kubelet_csr_approver_chart_version }}" - wait: true + wait: "{{ kube_network_plugin != 'cni' }}" + atomic: "{{ kube_network_plugin != 'cni' }}" values: "{{ kubelet_csr_approver_values }}" repositories: - name: "{{ kubelet_csr_approver_repository_name }}" diff --git a/kubespray/project/roles/kubernetes-apps/meta/main.yml b/kubespray/project/roles/kubernetes-apps/meta/main.yml index 37bd109..aefc8d2 100644 --- a/kubespray/project/roles/kubernetes-apps/meta/main.yml +++ b/kubespray/project/roles/kubernetes-apps/meta/main.yml @@ -10,12 +10,6 @@ dependencies: tags: - helm - - role: kubernetes-apps/krew - when: - - krew_enabled - tags: - - krew - - role: kubernetes-apps/registry when: - registry_enabled @@ -103,20 +97,12 @@ dependencies: tags: - container_engine_accelerator - - role: kubernetes-apps/cloud_controller/oci + - role: kubernetes-apps/kubelet-csr-approver when: - - cloud_provider is defined - - cloud_provider == "oci" + - kubelet_csr_approver_enabled - inventory_hostname == groups['kube_control_plane'][0] tags: - - oci - - - role: kubernetes-apps/gateway_api - when: - - gateway_api_enabled - - inventory_hostname == groups['kube_control_plane'][0] - tags: - - gateway_api + - kubelet-csr-approver - role: kubernetes-apps/metallb when: @@ -135,7 +121,7 @@ dependencies: - role: kubernetes-apps/scheduler_plugins when: - scheduler_plugins_enabled - - kube_major_version is version('v1.29', '<') + - kube_major_version is version('1.29', '<') - inventory_hostname == groups['kube_control_plane'][0] tags: - scheduler_plugins diff --git a/kubespray/project/roles/kubernetes-apps/metallb/OWNERS b/kubespray/project/roles/kubernetes-apps/metallb/OWNERS deleted file mode 100644 index b64c7bc..0000000 --- a/kubespray/project/roles/kubernetes-apps/metallb/OWNERS +++ /dev/null @@ -1,5 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: -reviewers: - - oomichi diff --git a/kubespray/project/roles/kubernetes-apps/metallb/templates/metallb.yaml.j2 b/kubespray/project/roles/kubernetes-apps/metallb/templates/metallb.yaml.j2 index ebdea51..9aca2cb 100644 --- a/kubespray/project/roles/kubernetes-apps/metallb/templates/metallb.yaml.j2 +++ b/kubespray/project/roles/kubernetes-apps/metallb/templates/metallb.yaml.j2 @@ -1716,7 +1716,7 @@ spec: value: memberlist - name: METALLB_DEPLOYMENT value: controller - image: "{{ metallb_controller_image_repo }}:{{ metallb_version }}" + image: "{{ metallb_controller_image_repo }}:{{ metallb_image_tag }}" livenessProbe: failureThreshold: 3 httpGet: @@ -1824,7 +1824,7 @@ spec: secretKeyRef: key: secretkey name: memberlist - image: "{{ metallb_speaker_image_repo }}:{{ metallb_version }}" + image: "{{ metallb_speaker_image_repo }}:{{ metallb_image_tag }}" livenessProbe: failureThreshold: 3 httpGet: diff --git a/kubespray/project/roles/kubernetes-apps/metrics_server/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/metrics_server/defaults/main.yml index 934e67b..ed43734 100644 --- a/kubespray/project/roles/kubernetes-apps/metrics_server/defaults/main.yml +++ b/kubespray/project/roles/kubernetes-apps/metrics_server/defaults/main.yml @@ -9,6 +9,6 @@ metrics_server_requests_cpu: 100m metrics_server_requests_memory: 200Mi metrics_server_host_network: false metrics_server_replicas: 1 -# metrics_server_extra_tolerations: [] -# metrics_server_extra_affinity: {} -# metrics_server_nodeselector: {} +metrics_server_extra_tolerations: [] +metrics_server_extra_affinity: {} +metrics_server_nodeselector: {} diff --git a/kubespray/project/roles/kubernetes-apps/metrics_server/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/metrics_server/tasks/main.yml index 3517686..1a32fda 100644 --- a/kubespray/project/roles/kubernetes-apps/metrics_server/tasks/main.yml +++ b/kubespray/project/roles/kubernetes-apps/metrics_server/tasks/main.yml @@ -1,9 +1,4 @@ --- -# If all masters have node role, there are no tainted master and toleration should not be specified. -- name: Check all masters are node or not - set_fact: - masters_are_not_tainted: "{{ groups['kube_node'] | intersect(groups['kube_control_plane']) == groups['kube_control_plane'] }}" - - name: Metrics Server | Delete addon dir file: path: "{{ kube_config_dir }}/addons/metrics_server" diff --git a/kubespray/project/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2 b/kubespray/project/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2 index ce121fe..528e23a 100644 --- a/kubespray/project/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2 +++ b/kubespray/project/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2 @@ -85,16 +85,12 @@ spec: volumes: - name: tmp emptyDir: {} -{% if not masters_are_not_tainted or metrics_server_extra_tolerations is defined %} tolerations: -{% if not masters_are_not_tainted %} - key: node-role.kubernetes.io/control-plane effect: NoSchedule -{% endif %} -{% if metrics_server_extra_tolerations is defined %} +{% if metrics_server_extra_tolerations %} {{ metrics_server_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }} -{% endif %} -{% endif %} +{%- endif %} affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -109,10 +105,10 @@ spec: topologyKey: kubernetes.io/hostname namespaces: - kube-system -{% if metrics_server_extra_affinity is defined %} - {{ metrics_server_extra_affinity | to_nice_yaml | indent(width=8) }} -{% endif %} -{% if metrics_server_nodeselector is defined %} +{% if metrics_server_extra_affinity %} + {{ metrics_server_extra_affinity | to_nice_yaml(indent=2) | indent(8) }} +{%- endif %} +{% if metrics_server_nodeselector %} nodeSelector: - {{ metrics_server_nodeselector | to_nice_yaml | indent(width=8) }} -{% endif %} + {{ metrics_server_nodeselector | to_nice_yaml(indent=2) | indent(8) }} +{%- endif %} diff --git a/kubespray/project/roles/kubernetes-apps/network_plugin/kube-router/OWNERS b/kubespray/project/roles/kubernetes-apps/network_plugin/kube-router/OWNERS deleted file mode 100644 index c40af3c..0000000 --- a/kubespray/project/roles/kubernetes-apps/network_plugin/kube-router/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - bozzo -reviewers: - - bozzo diff --git a/kubespray/project/roles/kubernetes-apps/network_plugin/multus/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/network_plugin/multus/tasks/main.yml index 54dd1ed..d5dd016 100644 --- a/kubespray/project/roles/kubernetes-apps/network_plugin/multus/tasks/main.yml +++ b/kubespray/project/roles/kubernetes-apps/network_plugin/multus/tasks/main.yml @@ -9,7 +9,7 @@ state: "latest" delegate_to: "{{ groups['kube_control_plane'][0] }}" run_once: true - with_items: "{{ (multus_manifest_1.results | default([])) + (multus_nodes_list | map('extract', hostvars, 'multus_manifest_2.results') | default([]) | list) }}" + with_items: "{{ (multus_manifest_1.results | default([])) + (multus_nodes_list | map('extract', hostvars, 'multus_manifest_2') | map('default', []) | list | json_query('[].results')) }}" loop_control: label: "{{ item.item.name if item != None else 'skipped' }}" vars: diff --git a/kubespray/project/roles/kubernetes-apps/persistent_volumes/aws-ebs-csi/OWNERS b/kubespray/project/roles/kubernetes-apps/persistent_volumes/aws-ebs-csi/OWNERS deleted file mode 100644 index 6e44ceb..0000000 --- a/kubespray/project/roles/kubernetes-apps/persistent_volumes/aws-ebs-csi/OWNERS +++ /dev/null @@ -1,5 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - alijahnas -reviewers: diff --git a/kubespray/project/roles/kubernetes-apps/persistent_volumes/meta/main.yml b/kubespray/project/roles/kubernetes-apps/persistent_volumes/meta/main.yml index e3066bb..8cc9e69 100644 --- a/kubespray/project/roles/kubernetes-apps/persistent_volumes/meta/main.yml +++ b/kubespray/project/roles/kubernetes-apps/persistent_volumes/meta/main.yml @@ -1,12 +1,5 @@ --- dependencies: - - role: kubernetes-apps/persistent_volumes/openstack - when: - - cloud_provider is defined - - cloud_provider in [ 'openstack' ] - tags: - - persistent_volumes_openstack - - role: kubernetes-apps/persistent_volumes/cinder-csi when: - cinder_csi_enabled diff --git a/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/defaults/main.yml b/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/defaults/main.yml deleted file mode 100644 index 05a3d94..0000000 --- a/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/defaults/main.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -persistent_volumes_enabled: false -storage_classes: - - name: standard - is_default: true - parameters: - availability: nova diff --git a/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/tasks/main.yml b/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/tasks/main.yml deleted file mode 100644 index 90b3ad7..0000000 --- a/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/tasks/main.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: Kubernetes Persistent Volumes | Lay down OpenStack Cinder Storage Class template - template: - src: "openstack-storage-class.yml.j2" - dest: "{{ kube_config_dir }}/openstack-storage-class.yml" - mode: "0644" - register: manifests - when: - - inventory_hostname == groups['kube_control_plane'][0] - -- name: Kubernetes Persistent Volumes | Add OpenStack Cinder Storage Class - kube: - name: storage-class - kubectl: "{{ bin_dir }}/kubectl" - resource: StorageClass - filename: "{{ kube_config_dir }}/openstack-storage-class.yml" - state: "latest" - when: - - inventory_hostname == groups['kube_control_plane'][0] - - manifests.changed diff --git a/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/templates/openstack-storage-class.yml.j2 b/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/templates/openstack-storage-class.yml.j2 deleted file mode 100644 index 973353c..0000000 --- a/kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/templates/openstack-storage-class.yml.j2 +++ /dev/null @@ -1,27 +0,0 @@ -{% for class in storage_classes %} ---- -kind: StorageClass -apiVersion: storage.k8s.io/v1 -metadata: - name: "{{ class.name }}" - annotations: - storageclass.kubernetes.io/is-default-class: "{{ class.is_default | default(false) | ternary("true","false") }}" -provisioner: kubernetes.io/cinder -{% if class.mount_options is defined %} -mountOptions: -{% for option in class.mount_options | default([]) %} - - "{{ option }}" -{% endfor %} -{% endif %} -parameters: -{% for key, value in (class.parameters | default({})).items() %} - "{{ key }}": "{{ value }}" -{% endfor %} -{% if class.reclaim_policy is defined %} -reclaimPolicy: "{{ class.reclaim_policy }}" -{% endif %} -{% if class.volume_binding_mode is defined %} -volumeBindingMode: "{{ class.volume_binding_mode }}" -{% endif %} -allowVolumeExpansion: {{ expand_persistent_volumes }} -{% endfor %} diff --git a/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2 b/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2 index 0941d29..36c22f1 100644 --- a/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2 @@ -30,6 +30,8 @@ spec: operator: Exists - key: node-role.kubernetes.io/control-plane effect: NoSchedule + - key: node-role.kubernetes.io/master + effect: NoSchedule {% if policy_controller_extra_tolerations is defined %} {{ policy_controller_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }} {% endif %} @@ -59,6 +61,8 @@ spec: - /usr/bin/check-status - -r periodSeconds: 10 + securityContext: + runAsNonRoot: true env: - name: LOG_LEVEL value: {{ calico_policy_controller_log_level }} @@ -68,6 +72,8 @@ spec: - name: DATASTORE_TYPE value: kubernetes {% else %} + - name: ENABLED_CONTROLLERS + value: policy,namespace,serviceaccount,workloadendpoint,node - name: ETCD_ENDPOINTS value: "{{ etcd_access_addresses }}" - name: ETCD_CA_CERT_FILE diff --git a/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 b/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 index f74b291..27652f0 100644 --- a/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 +++ b/kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 @@ -19,19 +19,6 @@ rules: - watch - list - get - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - apiGroups: - - networking.k8s.io - resources: - - networkpolicies - verbs: - - watch - - list {% elif calico_datastore == "kdd" %} # Nodes are watched to monitor for deletions. - apiGroups: [""] @@ -67,6 +54,7 @@ rules: - blockaffinities - ipamblocks - ipamhandles + - tiers verbs: - get - list @@ -101,6 +89,7 @@ rules: verbs: # read its own config - get + - list # create a default if none exists - create # update status diff --git a/kubespray/project/roles/kubernetes-apps/vars/main.yml b/kubespray/project/roles/kubernetes-apps/vars/main.yml new file mode 100644 index 0000000..88f4a30 --- /dev/null +++ b/kubespray/project/roles/kubernetes-apps/vars/main.yml @@ -0,0 +1,2 @@ +--- +kubectl_apply_stdin: "{{ kubectl }} apply -f - -n {{ namespace }}" diff --git a/kubespray/project/roles/kubernetes/client/tasks/main.yml b/kubespray/project/roles/kubernetes/client/tasks/main.yml index 9202051..bb0786d 100644 --- a/kubespray/project/roles/kubernetes/client/tasks/main.yml +++ b/kubespray/project/roles/kubernetes/client/tasks/main.yml @@ -71,7 +71,7 @@ user_certs: "{{ admin_kubeconfig['users'][0]['user'] }}" username: "kubernetes-admin-{{ cluster_name }}" context: "kubernetes-admin-{{ cluster_name }}@{{ cluster_name }}" - override_cluster_name: "{{ {'clusters': [{'cluster': (cluster_infos | combine({'server': 'https://' + external_apiserver_address + ':' + (external_apiserver_port | string)})), 'name': cluster_name}]} }}" + override_cluster_name: "{{ {'clusters': [{'cluster': (cluster_infos | combine({'server': 'https://' + (external_apiserver_address | ansible.utils.ipwrap) + ':' + (external_apiserver_port | string)})), 'name': cluster_name}]} }}" override_context: "{{ {'contexts': [{'context': {'user': username, 'cluster': cluster_name}, 'name': context}], 'current-context': context} }}" override_user: "{{ {'users': [{'name': username, 'user': user_certs}]} }}" when: kubeconfig_localhost diff --git a/kubespray/project/roles/kubernetes/control-plane/defaults/main/etcd.yml b/kubespray/project/roles/kubernetes/control-plane/defaults/main/etcd.yml index 344ce9b..e1755c5 100644 --- a/kubespray/project/roles/kubernetes/control-plane/defaults/main/etcd.yml +++ b/kubespray/project/roles/kubernetes/control-plane/defaults/main/etcd.yml @@ -14,8 +14,6 @@ etcd_cert_alt_ips: [] etcd_heartbeat_interval: "250" etcd_election_timeout: "5000" -# etcd_snapshot_count: "10000" - etcd_metrics: "basic" ## A dictionary of extra environment variables to add to etcd.env, formatted like: diff --git a/kubespray/project/roles/kubernetes/control-plane/defaults/main/kube-scheduler.yml b/kubespray/project/roles/kubernetes/control-plane/defaults/main/kube-scheduler.yml index e61bcb7..98092f4 100644 --- a/kubespray/project/roles/kubernetes/control-plane/defaults/main/kube-scheduler.yml +++ b/kubespray/project/roles/kubernetes/control-plane/defaults/main/kube-scheduler.yml @@ -4,7 +4,7 @@ kube_kubeadm_scheduler_extra_args: {} # Associated interface must be reachable by the rest of the cluster, and by # CLI/web clients. -kube_scheduler_bind_address: 0.0.0.0 +kube_scheduler_bind_address: "::" # ClientConnection options (e.g. Burst, QPS) except from kubeconfig. kube_scheduler_client_conn_extra_opts: {} diff --git a/kubespray/project/roles/kubernetes/control-plane/defaults/main/main.yml b/kubespray/project/roles/kubernetes/control-plane/defaults/main/main.yml index df92c41..71ecfc4 100644 --- a/kubespray/project/roles/kubernetes/control-plane/defaults/main/main.yml +++ b/kubespray/project/roles/kubernetes/control-plane/defaults/main/main.yml @@ -5,8 +5,8 @@ upgrade_cluster_setup: false # By default the external API listens on all interfaces, this can be changed to # listen on a specific address/interface. # NOTE: If you specific address/interface and use loadbalancer_apiserver_localhost -# loadbalancer_apiserver_localhost (nginx/haproxy) will deploy on masters on 127.0.0.1:{{ loadbalancer_apiserver_port | default(kube_apiserver_port) }} too. -kube_apiserver_bind_address: 0.0.0.0 +# loadbalancer_apiserver_localhost (nginx/haproxy) will deploy on control plane nodes on 127.0.0.1:{{ loadbalancer_apiserver_port | default(kube_apiserver_port) }} too. +kube_apiserver_bind_address: "::" # A port range to reserve for services with NodePort visibility. # Inclusive at both ends of the range. @@ -29,7 +29,7 @@ kube_etcd_key_file: node-{{ inventory_hostname }}-key.pem # Associated interfaces must be reachable by the rest of the cluster, and by # CLI/web clients. -kube_controller_manager_bind_address: 0.0.0.0 +kube_controller_manager_bind_address: "::" # Leader election lease durations and timeouts for controller-manager kube_controller_manager_leader_elect_lease_duration: 15s @@ -38,7 +38,7 @@ kube_controller_manager_leader_elect_renew_deadline: 10s # discovery_timeout modifies the discovery timeout discovery_timeout: 5m0s -# Instruct first master to refresh kubeadm token +# Instruct first control plane node to refresh kubeadm token kubeadm_refresh_token: true # Scale down coredns replicas to 0 if not using coredns dns_mode @@ -107,18 +107,29 @@ kube_apiserver_admission_control_config_file: false # cache_size: kube_apiserver_admission_event_rate_limits: {} +## PodSecurityAdmission plugin configuration kube_pod_security_use_default: false kube_pod_security_default_enforce: baseline -kube_pod_security_default_enforce_version: "{{ kube_major_version }}" +kube_pod_security_default_enforce_version: "v{{ kube_major_version }}" kube_pod_security_default_audit: restricted -kube_pod_security_default_audit_version: "{{ kube_major_version }}" +kube_pod_security_default_audit_version: "v{{ kube_major_version }}" kube_pod_security_default_warn: restricted -kube_pod_security_default_warn_version: "{{ kube_major_version }}" +kube_pod_security_default_warn_version: "v{{ kube_major_version }}" kube_pod_security_exemptions_usernames: [] kube_pod_security_exemptions_runtime_class_names: [] kube_pod_security_exemptions_namespaces: - kube-system +## ResourceQuota plugin configuration +## Resources that ResourceQuota should limit by default if no quota exists +## Example below enforces quota on all storage classes +# kube_resource_quota_limited_resources: +# - apiGroup: "" +# resource: persistentvolumeclaims +# matchContains: +# - .storageclass.storage.k8s.io/requests.storage +kube_resource_quota_limited_resources: [] + # 1.10+ list of disabled admission plugins kube_apiserver_disable_admission_plugins: [] @@ -184,13 +195,6 @@ kube_encryption_algorithm: "secretbox" # Which kubernetes resources to encrypt kube_encryption_resources: [secrets] -# If non-empty, will use this string as identification instead of the actual hostname -kube_override_hostname: >- - {%- if cloud_provider is defined and cloud_provider in ['aws'] -%} - {%- else -%} - {{ inventory_hostname }} - {%- endif -%} - secrets_encryption_query: "resources[*].providers[0].{{ kube_encryption_algorithm }}.keys[0].secret" ## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. @@ -238,8 +242,16 @@ kubeadm_upgrade_auto_cert_renewal: true ## Enable distributed tracing for kube-apiserver kube_apiserver_tracing: false -kube_apiserver_tracing_endpoint: 0.0.0.0:4317 +kube_apiserver_tracing_endpoint: "[::]:4317" kube_apiserver_tracing_sampling_rate_per_million: 100 # Enable kubeadm file discovery if anonymous access has been removed kubeadm_use_file_discovery: "{{ remove_anonymous_access }}" + +# imagePullSerial specifies if image pulling performed by kubeadm must be done serially or in parallel. Default: true +kubeadm_image_pull_serial: true + +# Supported asymmetric encryption algorithm types for the cluster's keys and certificates. +# can be one of RSA-2048(default), RSA-3072, RSA-4096, ECDSA-P256 +# ref: https://kubernetes.io/docs/reference/config-api/kubeadm-config.v1beta4/#kubeadm-k8s-io-v1beta4-ClusterConfiguration +kube_asymmetric_encryption_algorithm: "RSA-2048" diff --git a/kubespray/project/roles/kubernetes/control-plane/handlers/main.yml b/kubespray/project/roles/kubernetes/control-plane/handlers/main.yml index 3d7f3e0..3a948ca 100644 --- a/kubespray/project/roles/kubernetes/control-plane/handlers/main.yml +++ b/kubespray/project/roles/kubernetes/control-plane/handlers/main.yml @@ -1,16 +1,16 @@ --- -- name: Master | reload systemd +- name: Control plane | reload systemd systemd_service: daemon_reload: true - listen: Master | restart kubelet + listen: Control plane | restart kubelet -- name: Master | reload kubelet +- name: Control plane | reload kubelet service: name: kubelet state: restarted - listen: Master | restart kubelet + listen: Control plane | restart kubelet -- name: Master | Remove apiserver container docker +- name: Control plane | Remove apiserver container docker shell: "set -o pipefail && docker ps -af name=k8s_kube-apiserver* -q | xargs --no-run-if-empty docker rm -f" args: executable: /bin/bash @@ -19,10 +19,10 @@ until: remove_apiserver_container.rc == 0 delay: 1 when: container_manager == "docker" - listen: Master | Restart apiserver + listen: Control plane | Restart apiserver -- name: Master | Remove apiserver container containerd/crio - shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-apiserver* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'" +- name: Control plane | Remove apiserver container containerd/crio + shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name 'kube-apiserver*' -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'" args: executable: /bin/bash register: remove_apiserver_container @@ -30,9 +30,9 @@ until: remove_apiserver_container.rc == 0 delay: 1 when: container_manager in ['containerd', 'crio'] - listen: Master | Restart apiserver + listen: Control plane | Restart apiserver -- name: Master | Remove scheduler container docker +- name: Control plane | Remove scheduler container docker shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -af name=k8s_kube-scheduler* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f" args: executable: /bin/bash @@ -41,10 +41,10 @@ until: remove_scheduler_container.rc == 0 delay: 1 when: container_manager == "docker" - listen: Master | Restart kube-scheduler + listen: Control plane | Restart kube-scheduler -- name: Master | Remove scheduler container containerd/crio - shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-scheduler* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'" +- name: Control plane | Remove scheduler container containerd/crio + shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name 'kube-scheduler*' -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'" args: executable: /bin/bash register: remove_scheduler_container @@ -52,9 +52,9 @@ until: remove_scheduler_container.rc == 0 delay: 1 when: container_manager in ['containerd', 'crio'] - listen: Master | Restart kube-scheduler + listen: Control plane | Restart kube-scheduler -- name: Master | Remove controller manager container docker +- name: Control plane | Remove controller manager container docker shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -af name=k8s_kube-controller-manager* -q | xargs --no-run-if-empty {{ docker_bin_dir }}/docker rm -f" args: executable: /bin/bash @@ -63,10 +63,10 @@ until: remove_cm_container.rc == 0 delay: 1 when: container_manager == "docker" - listen: Master | Restart kube-controller-manager + listen: Control plane | Restart kube-controller-manager -- name: Master | Remove controller manager container containerd/crio - shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name kube-controller-manager* -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'" +- name: Control plane | Remove controller manager container containerd/crio + shell: "set -o pipefail && {{ bin_dir }}/crictl pods --name 'kube-controller-manager*' -q | xargs -I% --no-run-if-empty bash -c '{{ bin_dir }}/crictl stopp % && {{ bin_dir }}/crictl rmp %'" args: executable: /bin/bash register: remove_cm_container @@ -74,11 +74,11 @@ until: remove_cm_container.rc == 0 delay: 1 when: container_manager in ['containerd', 'crio'] - listen: Master | Restart kube-controller-manager + listen: Control plane | Restart kube-controller-manager -- name: Master | wait for kube-scheduler +- name: Control plane | wait for kube-scheduler vars: - endpoint: "{{ kube_scheduler_bind_address if kube_scheduler_bind_address != '0.0.0.0' else 'localhost' }}" + endpoint: "{{ kube_scheduler_bind_address if kube_scheduler_bind_address != '::' else 'localhost' }}" uri: url: https://{{ endpoint }}:10259/healthz validate_certs: false @@ -87,12 +87,12 @@ retries: 60 delay: 1 listen: - - Master | restart kubelet - - Master | Restart kube-scheduler + - Control plane | restart kubelet + - Control plane | Restart kube-scheduler -- name: Master | wait for kube-controller-manager +- name: Control plane | wait for kube-controller-manager vars: - endpoint: "{{ kube_controller_manager_bind_address if kube_controller_manager_bind_address != '0.0.0.0' else 'localhost' }}" + endpoint: "{{ kube_controller_manager_bind_address if kube_controller_manager_bind_address != '::' else 'localhost' }}" uri: url: https://{{ endpoint }}:10257/healthz validate_certs: false @@ -101,10 +101,10 @@ retries: 60 delay: 1 listen: - - Master | restart kubelet - - Master | Restart kube-controller-manager + - Control plane | restart kubelet + - Control plane | Restart kube-controller-manager -- name: Master | wait for the apiserver to be running +- name: Control plane | wait for the apiserver to be running uri: url: "{{ kube_apiserver_endpoint }}/healthz" validate_certs: false @@ -113,5 +113,5 @@ retries: 60 delay: 1 listen: - - Master | restart kubelet - - Master | Restart apiserver + - Control plane | restart kubelet + - Control plane | Restart apiserver diff --git a/kubespray/project/roles/kubernetes/control-plane/meta/main.yml b/kubespray/project/roles/kubernetes/control-plane/meta/main.yml index 7d793f9..9e5d86e 100644 --- a/kubespray/project/roles/kubernetes/control-plane/meta/main.yml +++ b/kubespray/project/roles/kubernetes/control-plane/meta/main.yml @@ -1,9 +1,6 @@ --- dependencies: - - role: kubernetes/tokens - when: kube_token_auth - tags: - - k8s-secrets + - role: kubernetes/kubeadm_common - role: adduser user: "{{ addusers.etcd }}" when: diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/check-api.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/check-api.yml new file mode 100644 index 0000000..592bcec --- /dev/null +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/check-api.yml @@ -0,0 +1,10 @@ +--- +- name: Kubeadm | Check api is up + uri: + url: "https://{{ ip | default(fallback_ip) }}:{{ kube_apiserver_port }}/healthz" + validate_certs: false + when: ('kube_control_plane' in group_names) + register: _result + retries: 60 + delay: 5 + until: _result.status == 200 diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml index 2950c76..15b5496 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/encrypt-at-rest.yml @@ -23,7 +23,7 @@ kube_encrypt_token_extracted: "{{ secret_file_decoded | json_query(secrets_encryption_query) | first | b64decode }}" when: secrets_encryption_file.stat.exists -- name: Set kube_encrypt_token across master nodes +- name: Set kube_encrypt_token across control plane nodes set_fact: kube_encrypt_token: "{{ kube_encrypt_token_extracted }}" delegate_to: "{{ item }}" diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml index e47f571..919e8b6 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-fix-apiserver.yml @@ -12,6 +12,6 @@ - kubelet.conf - scheduler.conf notify: - - "Master | Restart kube-controller-manager" - - "Master | Restart kube-scheduler" - - "Master | reload kubelet" + - "Control plane | Restart kube-controller-manager" + - "Control plane | Restart kube-scheduler" + - "Control plane | reload kubelet" diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml index 413d494..c797a88 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-secondary.yml @@ -4,7 +4,7 @@ # noqa: jinja[spacing] kubeadm_discovery_address: >- {%- if "127.0.0.1" in kube_apiserver_endpoint or "localhost" in kube_apiserver_endpoint -%} - {{ first_kube_control_plane_address }}:{{ kube_apiserver_port }} + {{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} {%- else -%} {{ kube_apiserver_endpoint | regex_replace('https://', '') }} {%- endif %} @@ -24,26 +24,27 @@ - name: Parse certificate key if not set set_fact: - kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}" + kubeadm_certificate_key: "{{ hostvars[first_kube_control_plane]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}" run_once: true when: - - hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is defined - - hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is not skipped + - hostvars[first_kube_control_plane]['kubeadm_upload_cert'] is defined + - hostvars[first_kube_control_plane]['kubeadm_upload_cert'] is not skipped - name: Create kubeadm ControlPlane config template: - src: "kubeadm-controlplane.{{ kubeadmConfig_api_version }}.yaml.j2" + src: "kubeadm-controlplane.yaml.j2" dest: "{{ kube_config_dir }}/kubeadm-controlplane.yaml" mode: "0640" backup: true + validate: "{{ kubeadm_config_validate_enabled | ternary(bin_dir + '/kubeadm config validate --config %s', omit) }}" when: - inventory_hostname != first_kube_control_plane - not kubeadm_already_run.stat.exists - name: Wait for k8s apiserver wait_for: - host: "{{ kubeadm_discovery_address.split(':')[0] }}" - port: "{{ kubeadm_discovery_address.split(':')[1] }}" + host: "{{ kubeadm_discovery_address | regex_replace('\\]?:\\d+$', '') | regex_replace('^\\[', '') }}" + port: "{{ kubeadm_discovery_address.split(':')[-1] }}" timeout: 180 @@ -87,7 +88,7 @@ command: >- {{ bin_dir }}/kubeadm join --config {{ kube_config_dir }}/kubeadm-controlplane.yaml - --ignore-preflight-errors=all + --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }} --skip-phases={{ kubeadm_join_phases_skip | join(',') }} environment: PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}" diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml index 52700af..823e61c 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml @@ -35,12 +35,13 @@ - "{{ kube_apiserver_ip }}" - "localhost" - "127.0.0.1" + - "::1" sans_lb: "{{ [apiserver_loadbalancer_domain_name] if apiserver_loadbalancer_domain_name is defined else [] }}" sans_lb_ip: "{{ [loadbalancer_apiserver.address] if loadbalancer_apiserver is defined and loadbalancer_apiserver.address is defined else [] }}" sans_supp: "{{ supplementary_addresses_in_ssl_keys if supplementary_addresses_in_ssl_keys is defined else [] }}" - sans_access_ip: "{{ groups['kube_control_plane'] | map('extract', hostvars, 'access_ip') | list | select('defined') | list }}" - sans_ip: "{{ groups['kube_control_plane'] | map('extract', hostvars, 'ip') | list | select('defined') | list }}" - sans_address: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | list | select('defined') | list }}" + sans_access_ip: "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_access_ip') | list | select('defined') | list }}" + sans_ip: "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_ip') | list | select('defined') | list }}" + sans_address: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_default_ipv6', 'ansible_default_ipv4', 'address']) | list | select('defined') | list }}" sans_override: "{{ [kube_override_hostname] if kube_override_hostname else [] }}" sans_hostname: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_hostname']) | list | select('defined') | list }}" sans_fqdn: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_fqdn']) | list | select('defined') | list }}" @@ -52,21 +53,23 @@ path: "{{ audit_policy_file | dirname }}" state: directory mode: "0640" - when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false) + when: kubernetes_audit or kubernetes_audit_webhook - name: Write api audit policy yaml template: src: apiserver-audit-policy.yaml.j2 dest: "{{ audit_policy_file }}" mode: "0640" - when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false) + when: kubernetes_audit or kubernetes_audit_webhook + notify: Control plane | Restart apiserver - name: Write api audit webhook config yaml template: src: apiserver-audit-webhook-config.yaml.j2 dest: "{{ audit_webhook_config_file }}" mode: "0640" - when: kubernetes_audit_webhook | default(false) + when: kubernetes_audit_webhook + notify: Control plane | Restart apiserver - name: Create apiserver tracing config directory file: @@ -81,6 +84,7 @@ dest: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml" mode: "0640" when: kube_apiserver_tracing + notify: Control plane | Restart apiserver # Nginx LB(default), If kubeadm_config_api_fqdn is defined, use other LB by kubeadm controlPlaneEndpoint. - name: Set kubeadm_config_api_fqdn define @@ -88,15 +92,12 @@ kubeadm_config_api_fqdn: "{{ apiserver_loadbalancer_domain_name | default('lb-apiserver.kubernetes.local') }}" when: loadbalancer_apiserver is defined -- name: Set kubeadm api version to v1beta3 - set_fact: - kubeadmConfig_api_version: v1beta3 - - name: Kubeadm | Create kubeadm config template: - src: "kubeadm-config.{{ kubeadmConfig_api_version }}.yaml.j2" + src: "kubeadm-config.{{ kubeadm_config_api_version }}.yaml.j2" dest: "{{ kube_config_dir }}/kubeadm-config.yaml" mode: "0640" + validate: "{{ kubeadm_config_validate_enabled | ternary(bin_dir + '/kubeadm config validate --config %s', omit) }}" - name: Kubeadm | Create directory to store admission control configurations file: @@ -111,6 +112,7 @@ dest: "{{ kube_config_dir }}/admission-controls/admission-controls.yaml" mode: "0640" when: kube_apiserver_admission_control_config_file + notify: Control plane | Restart apiserver - name: Kubeadm | Push admission control config files template: @@ -121,15 +123,7 @@ - kube_apiserver_admission_control_config_file - item in kube_apiserver_admission_plugins_needs_configuration loop: "{{ kube_apiserver_enable_admission_plugins }}" - -- name: Kubeadm | Configure default cluster podnodeslector - template: - src: "podnodeselector.yaml.j2" - dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml" - mode: "0640" - when: - - kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined - - kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0 + notify: Control plane | Restart apiserver - name: Kubeadm | Check apiserver.crt SANs vars: @@ -145,12 +139,14 @@ loop: "{{ apiserver_ips }}" register: apiserver_sans_ip_check changed_when: apiserver_sans_ip_check.stdout is not search('does match certificate') + failed_when: apiserver_sans_ip_check.rc != 0 and apiserver_sans_ip_check.stdout is not search('does NOT match certificate') - name: Kubeadm | Check apiserver.crt SAN hosts command: cmd: "openssl x509 -noout -in {{ kube_cert_dir }}/apiserver.crt -checkhost {{ item }}" loop: "{{ apiserver_hosts }}" register: apiserver_sans_host_check changed_when: apiserver_sans_host_check.stdout is not search('does match certificate') + failed_when: apiserver_sans_host_check.rc != 0 and apiserver_sans_host_check.stdout is not search('does NOT match certificate') - name: Kubeadm | regenerate apiserver cert 1/2 file: @@ -174,38 +170,33 @@ - apiserver_sans_ip_check.changed or apiserver_sans_host_check.changed - not kube_external_ca_mode -- name: Kubeadm | Create directory to store kubeadm patches - file: - path: "{{ kubeadm_patches.dest_dir }}" - state: directory - mode: "0640" - when: kubeadm_patches is defined and kubeadm_patches.enabled - -- name: Kubeadm | Copy kubeadm patches from inventory files - copy: - src: "{{ kubeadm_patches.source_dir }}/" - dest: "{{ kubeadm_patches.dest_dir }}" - owner: "root" - mode: "0644" - when: kubeadm_patches is defined and kubeadm_patches.enabled - -- name: Kubeadm | Initialize first master - command: >- - timeout -k {{ kubeadm_init_timeout }} {{ kubeadm_init_timeout }} - {{ bin_dir }}/kubeadm init - --config={{ kube_config_dir }}/kubeadm-config.yaml - --ignore-preflight-errors=all - --skip-phases={{ kubeadm_init_phases_skip | join(',') }} - {{ kube_external_ca_mode | ternary('', '--upload-certs') }} - register: kubeadm_init - # Retry is because upload config sometimes fails - retries: 3 - until: kubeadm_init is succeeded or "field is immutable" in kubeadm_init.stderr +- name: Kubeadm | Initialize first control plane node when: inventory_hostname == first_kube_control_plane and not kubeadm_already_run.stat.exists - failed_when: kubeadm_init.rc != 0 and "field is immutable" not in kubeadm_init.stderr + vars: + kubeadm_init_first_control_plane_cmd: >- + timeout -k {{ kubeadm_init_timeout }} {{ kubeadm_init_timeout }} + {{ bin_dir }}/kubeadm init + --config={{ kube_config_dir }}/kubeadm-config.yaml + --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }} + --skip-phases={{ kubeadm_init_phases_skip | join(',') }} + {{ kube_external_ca_mode | ternary('', '--upload-certs') }} environment: PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}" - notify: Master | restart kubelet + notify: Control plane | restart kubelet + block: + - name: Kubeadm | Initialize first control plane node (1st try) + command: "{{ kubeadm_init_first_control_plane_cmd }}" + register: kubeadm_init + failed_when: kubeadm_init.rc != 0 and "field is immutable" not in kubeadm_init.stderr + rescue: + # Retry is because upload config sometimes fails + # This retry task is separated from 1st task to show log of failure of 1st task. + - name: Kubeadm | Initialize first control plane node (retry) + command: "{{ kubeadm_init_first_control_plane_cmd }}" + register: kubeadm_init + retries: 2 + until: kubeadm_init is succeeded or "field is immutable" in kubeadm_init.stderr + failed_when: kubeadm_init.rc != 0 and "field is immutable" not in kubeadm_init.stderr - name: Set kubeadm certificate key set_fact: @@ -250,20 +241,20 @@ tags: - kubeadm_token -- name: Kubeadm | Join other masters +- name: Kubeadm | Join other control plane nodes include_tasks: kubeadm-secondary.yml -- name: Kubeadm | upgrade kubernetes cluster +- name: Kubeadm | upgrade kubernetes cluster to {{ kube_version }} include_tasks: kubeadm-upgrade.yml when: - upgrade_cluster_setup - kubeadm_already_run.stat.exists # FIXME(mattymo): from docs: If you don't want to taint your control-plane node, set this field to an empty slice, i.e. `taints: {}` in the YAML file. -- name: Kubeadm | Remove taint for master with node role +- name: Kubeadm | Remove taint for control plane node with node role command: "{{ kubectl }} taint node {{ inventory_hostname }} {{ item }}" delegate_to: "{{ first_kube_control_plane }}" with_items: - "node-role.kubernetes.io/control-plane:NoSchedule-" - when: inventory_hostname in groups['kube_node'] + when: ('kube_node' in group_names) failed_when: false diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml index f88921e..84f0087 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml @@ -1,55 +1,80 @@ --- -- name: Kubeadm | Check api is up - uri: - url: "https://{{ ip | default(fallback_ips[inventory_hostname]) }}:{{ kube_apiserver_port }}/healthz" - validate_certs: false - when: inventory_hostname in groups['kube_control_plane'] - register: _result - retries: 60 - delay: 5 - until: _result.status == 200 +- name: Ensure kube-apiserver is up before upgrade + import_tasks: check-api.yml -- name: Kubeadm | Upgrade first master + # kubeadm-config.v1beta4 with UpgradeConfiguration requires some values that were previously allowed as args to be specified in the config file +- name: Kubeadm | Upgrade first control plane node command: >- timeout -k 600s 600s - {{ bin_dir }}/kubeadm - upgrade apply -y {{ kube_version }} + {{ bin_dir }}/kubeadm upgrade apply -y v{{ kube_version }} + {%- if kubeadm_config_api_version == 'v1beta3' %} --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }} - --ignore-preflight-errors=all + --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }} --allow-experimental-upgrades - --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }} - {% if kubeadm_patches is defined and kubeadm_patches.enabled %}--patches={{ kubeadm_patches.dest_dir }}{% endif %} + --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | lower }} + {% if kubeadm_patches | length > 0 %}--patches={{ kubeadm_patches_dir }}{% endif %} --force + {%- else %} + --config={{ kube_config_dir }}/kubeadm-config.yaml + {%- endif -%} register: kubeadm_upgrade - # Retry is because upload config sometimes fails - retries: 3 - until: kubeadm_upgrade.rc == 0 when: inventory_hostname == first_kube_control_plane failed_when: kubeadm_upgrade.rc != 0 and "field is immutable" not in kubeadm_upgrade.stderr environment: PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}" - notify: Master | restart kubelet -- name: Kubeadm | Upgrade other masters +- name: Kubeadm | Upgrade other control plane nodes command: >- - timeout -k 600s 600s - {{ bin_dir }}/kubeadm - upgrade apply -y {{ kube_version }} + {{ bin_dir }}/kubeadm upgrade node + {%- if kubeadm_config_api_version == 'v1beta3' %} --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }} - --ignore-preflight-errors=all - --allow-experimental-upgrades - --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }} - {% if kubeadm_patches is defined and kubeadm_patches.enabled %}--patches={{ kubeadm_patches.dest_dir }}{% endif %} - --force + --ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }} + --etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | lower }} + {% if kubeadm_patches | length > 0 %}--patches={{ kubeadm_patches_dir }}{% endif %} + {%- else %} + --config={{ kube_config_dir }}/kubeadm-config.yaml + {%- endif -%} register: kubeadm_upgrade - # Retry is because upload config sometimes fails - retries: 3 - until: kubeadm_upgrade.rc == 0 when: inventory_hostname != first_kube_control_plane failed_when: kubeadm_upgrade.rc != 0 and "field is immutable" not in kubeadm_upgrade.stderr environment: PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}" - notify: Master | restart kubelet + +# kubeadm upgrade no longer reconciles ClusterConfiguration and KubeProxyConfiguration changes, this must be done separately after upgrade to ensure the latest config is applied +- name: Update kubeadm and kubelet configmaps after upgrade + command: "{{ bin_dir }}/kubeadm init phase upload-config all --config {{ kube_config_dir }}/kubeadm-config.yaml" + register: kubeadm_upload_config + # Retry is because upload config sometimes fails + retries: 3 + until: kubeadm_upload_config.rc == 0 + when: + - inventory_hostname == first_kube_control_plane + +- name: Update kube-proxy configmap after upgrade + command: "{{ bin_dir }}/kubeadm init phase addon kube-proxy --config {{ kube_config_dir }}/kubeadm-config.yaml" + register: kube_proxy_upload_config + # Retry is because upload config sometimes fails + retries: 3 + until: kube_proxy_upload_config.rc == 0 + when: + - inventory_hostname == first_kube_control_plane + - ('addon/kube-proxy' not in kubeadm_init_phases_skip) + +- name: Rewrite kubeadm managed etcd static pod manifests with updated configmap + command: "{{ bin_dir }}/kubeadm init phase etcd local --config {{ kube_config_dir }}/kubeadm-config.yaml" + when: + - etcd_deployment_type == "kubeadm" + notify: Control plane | restart kubelet + +- name: Rewrite kubernetes control plane static pod manifests with updated configmap + command: "{{ bin_dir }}/kubeadm init phase control-plane all --config {{ kube_config_dir }}/kubeadm-config.yaml" + notify: Control plane | restart kubelet + +- name: Flush kubelet handlers + meta: flush_handlers + +- name: Ensure kube-apiserver is up after upgrade and control plane configuration updates + import_tasks: check-api.yml - name: Kubeadm | Remove binding to anonymous user command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found" @@ -60,8 +85,8 @@ path: "{{ item }}" state: absent with_items: - - /root/.kube/cache - - /root/.kube/http-cache + - /root/.kube/cache + - /root/.kube/http-cache # FIXME: https://github.com/kubernetes/kubeadm/issues/1318 - name: Kubeadm | scale down coredns replicas to 0 if not using coredns dns_mode @@ -75,6 +100,6 @@ until: scale_down_coredns is succeeded run_once: true when: - - kubeadm_scale_down_coredns_enabled - - dns_mode not in ['coredns', 'coredns_dual'] + - kubeadm_scale_down_coredns_enabled + - dns_mode not in ['coredns', 'coredns_dual'] changed_when: false diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/kubelet-fix-client-cert-rotation.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/kubelet-fix-client-cert-rotation.yml index 409ecb0..16fec4e 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/kubelet-fix-client-cert-rotation.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/kubelet-fix-client-cert-rotation.yml @@ -6,7 +6,7 @@ line: ' client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem' backup: true notify: - - "Master | reload kubelet" + - "Control plane | reload kubelet" - name: Fixup kubelet client cert rotation 2/2 lineinfile: @@ -15,4 +15,4 @@ line: ' client-key: /var/lib/kubelet/pki/kubelet-client-current.pem' backup: true notify: - - "Master | reload kubelet" + - "Control plane | reload kubelet" diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/main.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/main.yml index 518bac9..a10ad9b 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/main.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/main.yml @@ -18,6 +18,18 @@ mode: "0640" when: kube_webhook_authorization | default(false) +- name: Create structured AuthorizationConfiguration file + copy: + content: "{{ authz_config | to_nice_yaml(indent=2, sort_keys=false) }}" + dest: "{{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml" + mode: "0640" + vars: + authz_config: + apiVersion: apiserver.config.k8s.io/{{ kube_apiserver_authorization_config_api_version }} + kind: AuthorizationConfiguration + authorizers: "{{ kube_apiserver_authorization_config_authorizers }}" + when: kube_apiserver_use_authorization_config_file + - name: Create kube-scheduler config template: src: kubescheduler-config.yaml.j2 @@ -43,7 +55,7 @@ - name: Install kubectl bash completion shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh" - when: ansible_os_family in ["Debian","RedHat"] + when: ansible_os_family in ["Debian","RedHat", "Suse"] tags: - kubectl ignore_errors: true # noqa ignore-errors @@ -54,7 +66,7 @@ owner: root group: root mode: "0755" - when: ansible_os_family in ["Debian","RedHat"] + when: ansible_os_family in ["Debian","RedHat", "Suse"] tags: - kubectl - upgrade @@ -73,7 +85,7 @@ state: present marker: "# Ansible entries {mark}" when: - - ansible_os_family in ["Debian","RedHat"] + - ansible_os_family in ["Debian","RedHat", "Suse"] - kubectl_alias is defined and kubectl_alias != "" tags: - kubectl @@ -93,6 +105,13 @@ - name: Include kubeadm secondary server apiserver fixes include_tasks: kubeadm-fix-apiserver.yml +- name: Cleanup unused AuthorizationConfiguration file versions + file: + path: "{{ kube_config_dir }}/apiserver-authorization-config-{{ item }}.yaml" + state: absent + loop: "{{ ['v1alpha1', 'v1beta1', 'v1'] | reject('equalto', kube_apiserver_authorization_config_api_version) | list }}" + when: kube_apiserver_use_authorization_config_file + - name: Include kubelet client cert rotation fixes include_tasks: kubelet-fix-client-cert-rotation.yml when: kubelet_rotate_certificates diff --git a/kubespray/project/roles/kubernetes/control-plane/tasks/pre-upgrade.yml b/kubespray/project/roles/kubernetes/control-plane/tasks/pre-upgrade.yml index 2d7dce5..72534da 100644 --- a/kubespray/project/roles/kubernetes/control-plane/tasks/pre-upgrade.yml +++ b/kubespray/project/roles/kubernetes/control-plane/tasks/pre-upgrade.yml @@ -1,5 +1,5 @@ --- -- name: "Pre-upgrade | Delete master manifests if etcd secrets changed" +- name: "Pre-upgrade | Delete control plane manifests if etcd secrets changed" file: path: "/etc/kubernetes/manifests/{{ item }}.manifest" state: absent @@ -8,14 +8,14 @@ register: kube_apiserver_manifest_replaced when: etcd_secret_changed | default(false) -- name: "Pre-upgrade | Delete master containers forcefully" # noqa no-handler +- name: "Pre-upgrade | Delete control plane containers forcefully" # noqa no-handler shell: "set -o pipefail && docker ps -af name=k8s_{{ item }}* -q | xargs --no-run-if-empty docker rm -f" args: executable: /bin/bash with_items: - ["kube-apiserver", "kube-controller-manager", "kube-scheduler"] when: kube_apiserver_manifest_replaced.changed - register: remove_master_container + register: remove_control_plane_container retries: 10 - until: remove_master_container.rc == 0 + until: remove_control_plane_container.rc == 0 delay: 1 diff --git a/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2 b/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2 index ca48a3a..37caf31 100644 --- a/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2 +++ b/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2 @@ -7,7 +7,7 @@ bootstrapTokens: ttl: "24h" {% endif %} localAPIEndpoint: - advertiseAddress: {{ kube_apiserver_address }} + advertiseAddress: "{{ kube_apiserver_address }}" bindPort: {{ kube_apiserver_port }} {% if kubeadm_certificate_key is defined %} certificateKey: {{ kubeadm_certificate_key }} @@ -16,7 +16,7 @@ nodeRegistration: {% if kube_override_hostname | default('') %} name: "{{ kube_override_hostname }}" {% endif %} -{% if inventory_hostname in groups['kube_control_plane'] and inventory_hostname not in groups['kube_node'] %} +{% if 'kube_control_plane' in group_names and 'kube_node' not in group_names %} taints: - effect: NoSchedule key: node-role.kubernetes.io/control-plane @@ -24,13 +24,13 @@ nodeRegistration: taints: [] {% endif %} criSocket: {{ cri_socket }} -{% if cloud_provider is defined and cloud_provider in ["external"] %} +{% if cloud_provider == "external" %} kubeletExtraArgs: cloud-provider: external {% endif %} -{% if kubeadm_patches is defined and kubeadm_patches.enabled %} +{% if kubeadm_patches | length > 0 %} patches: - directory: {{ kubeadm_patches.dest_dir }} + directory: {{ kubeadm_patches_dir }} {% endif %} --- apiVersion: kubeadm.k8s.io/v1beta3 @@ -41,7 +41,7 @@ etcd: external: endpoints: {% for endpoint in etcd_access_addresses.split(',') %} - - {{ endpoint }} + - "{{ endpoint }}" {% endfor %} caFile: {{ etcd_cert_dir }}/{{ kube_etcd_cacert_file }} certFile: {{ etcd_cert_dir }}/{{ kube_etcd_cert_file }} @@ -94,9 +94,9 @@ dns: imageTag: {{ coredns_image_tag }} networking: dnsDomain: {{ dns_domain }} - serviceSubnet: "{{ kube_service_addresses }}{{ ',' + kube_service_addresses_ipv6 if enable_dual_stack_networks else '' }}" + serviceSubnet: "{{ kube_service_subnets }}" {% if kube_network_plugin is defined and kube_network_plugin not in ["kube-ovn"] %} - podSubnet: "{{ kube_pods_subnet }}{{ ',' + kube_pods_subnet_ipv6 if enable_dual_stack_networks else '' }}" + podSubnet: "{{ kube_pods_subnets }}" {% endif %} {% if kubeadm_feature_gates %} featureGates: @@ -104,11 +104,11 @@ featureGates: {{ feature | replace("=", ": ") }} {% endfor %} {% endif %} -kubernetesVersion: {{ kube_version }} +kubernetesVersion: v{{ kube_version }} {% if kubeadm_config_api_fqdn is defined %} -controlPlaneEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }} +controlPlaneEndpoint: "{{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}" {% else %} -controlPlaneEndpoint: {{ ip | default(fallback_ips[inventory_hostname]) }}:{{ kube_apiserver_port }} +controlPlaneEndpoint: "{{ main_ip | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}" {% endif %} certificatesDir: {{ kube_cert_dir }} imageRepository: {{ kube_image_repo }} @@ -126,8 +126,12 @@ apiServer: {% if kube_api_anonymous_auth is defined %} anonymous-auth: "{{ kube_api_anonymous_auth }}" {% endif %} +{% if kube_apiserver_use_authorization_config_file %} + authorization-config: "{{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml" +{% else %} authorization-mode: {{ authorization_modes | join(',') }} - bind-address: {{ kube_apiserver_bind_address }} +{% endif %} + bind-address: "{{ kube_apiserver_bind_address }}" {% if kube_apiserver_enable_admission_plugins | length > 0 %} enable-admission-plugins: {{ kube_apiserver_enable_admission_plugins | join(',') }} {% endif %} @@ -143,12 +147,12 @@ apiServer: etcd-servers-overrides: "/events#{{ etcd_events_access_addresses_semicolon }}" {% endif %} service-node-port-range: {{ kube_apiserver_node_port_range }} - service-cluster-ip-range: "{{ kube_service_addresses }}{{ ',' + kube_service_addresses_ipv6 if enable_dual_stack_networks else '' }}" + service-cluster-ip-range: "{{ kube_service_subnets }}" kubelet-preferred-address-types: "{{ kubelet_preferred_address_types }}" profiling: "{{ kube_profiling }}" request-timeout: "{{ kube_apiserver_request_timeout }}" enable-aggregator-routing: "{{ kube_api_aggregator_routing }}" -{% if kube_token_auth | default(true) %} +{% if kube_token_auth %} token-auth-file: {{ kube_token_dir }}/known_tokens.csv {% endif %} {% if kube_apiserver_service_account_lookup %} @@ -176,7 +180,7 @@ apiServer: {% if kube_webhook_token_auth | default(false) %} authentication-token-webhook-config-file: {{ kube_config_dir }}/webhook-token-auth-config.yaml {% endif %} -{% if kube_webhook_authorization | default(false) %} +{% if kube_webhook_authorization and not kube_apiserver_use_authorization_config_file %} authorization-webhook-config-file: {{ kube_config_dir }}/webhook-authorization-config.yaml {% endif %} {% if kube_encrypt_secret_data %} @@ -210,10 +214,6 @@ apiServer: {% if kube_apiserver_feature_gates or kube_feature_gates %} feature-gates: "{{ kube_apiserver_feature_gates | default(kube_feature_gates, true) | join(',') }}" {% endif %} -{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} - cloud-provider: {{ cloud_provider }} - cloud-config: {{ kube_config_dir }}/cloud_config -{% endif %} {% if tls_min_version is defined %} tls-min-version: {{ tls_min_version }} {% endif %} @@ -230,14 +230,9 @@ apiServer: {% if kube_apiserver_tracing %} tracing-config-file: {{ kube_config_dir }}/tracing/apiserver-tracing.yaml {% endif %} -{% if kubernetes_audit or kube_token_auth | default(true) or kube_webhook_token_auth | default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] ) or apiserver_extra_volumes or ssl_ca_dirs | length %} +{% if kubernetes_audit or kube_token_auth or kube_webhook_token_auth or apiserver_extra_volumes or ssl_ca_dirs | length %} extraVolumes: -{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} - - name: cloud-config - hostPath: {{ kube_config_dir }}/cloud_config - mountPath: {{ kube_config_dir }}/cloud_config -{% endif %} -{% if kube_token_auth | default(true) %} +{% if kube_token_auth %} - name: token-auth-config hostPath: {{ kube_token_dir }} mountPath: {{ kube_token_dir }} @@ -252,6 +247,11 @@ apiServer: hostPath: {{ kube_config_dir }}/webhook-authorization-config.yaml mountPath: {{ kube_config_dir }}/webhook-authorization-config.yaml {% endif %} +{% if kube_apiserver_use_authorization_config_file %} + - name: authorization-config + hostPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml + mountPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml +{% endif %} {% if kubernetes_audit or kubernetes_audit_webhook %} - name: {{ audit_policy_name }} hostPath: {{ audit_policy_hostpath }} @@ -294,7 +294,7 @@ apiServer: {% endif %} certSANs: {% for san in apiserver_sans %} - - "{{ san }}" + - {{ san }} {% endfor %} timeoutForControlPlane: 5m0s controllerManager: @@ -302,22 +302,22 @@ controllerManager: node-monitor-grace-period: {{ kube_controller_node_monitor_grace_period }} node-monitor-period: {{ kube_controller_node_monitor_period }} {% if kube_network_plugin is defined and kube_network_plugin not in ["kube-ovn"] %} - cluster-cidr: "{{ kube_pods_subnet }}{{ ',' + kube_pods_subnet_ipv6 if enable_dual_stack_networks else '' }}" + cluster-cidr: "{{ kube_pods_subnets }}" {% endif %} - service-cluster-ip-range: "{{ kube_service_addresses }}{{ ',' + kube_service_addresses_ipv6 if enable_dual_stack_networks else '' }}" + service-cluster-ip-range: "{{ kube_service_subnets }}" {% if kube_network_plugin is defined and kube_network_plugin == "calico" and not calico_ipam_host_local %} allocate-node-cidrs: "false" {% else %} -{% if enable_dual_stack_networks %} +{% if ipv4_stack %} node-cidr-mask-size-ipv4: "{{ kube_network_node_prefix }}" +{% endif %} +{% if ipv6_stack %} node-cidr-mask-size-ipv6: "{{ kube_network_node_prefix_ipv6 }}" -{% else %} - node-cidr-mask-size: "{{ kube_network_node_prefix }}" {% endif %} {% endif %} profiling: "{{ kube_profiling }}" terminated-pod-gc-threshold: "{{ kube_controller_terminated_pod_gc_threshold }}" - bind-address: {{ kube_controller_manager_bind_address }} + bind-address: "{{ kube_controller_manager_bind_address }}" leader-elect-lease-duration: {{ kube_controller_manager_leader_elect_lease_duration }} leader-elect-renew-deadline: {{ kube_controller_manager_leader_elect_renew_deadline }} {% if kube_controller_feature_gates or kube_feature_gates %} @@ -326,10 +326,6 @@ controllerManager: {% for key in kube_kubeadm_controller_extra_args %} {{ key }}: "{{ kube_kubeadm_controller_extra_args[key] }}" {% endfor %} -{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} - cloud-provider: {{ cloud_provider }} - cloud-config: {{ kube_config_dir }}/cloud_config -{% endif %} {% if kube_network_plugin is defined and kube_network_plugin not in ["cloud"] %} configure-cloud-routes: "false" {% endif %} @@ -343,18 +339,8 @@ controllerManager: tls-cipher-suites: {% for tls in tls_cipher_suites %}{{ tls }}{{ "," if not loop.last else "" }}{% endfor %} {% endif %} -{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] or controller_manager_extra_volumes %} +{% if controller_manager_extra_volumes %} extraVolumes: -{% if cloud_provider is defined and cloud_provider in ["openstack"] and openstack_cacert is defined %} - - name: openstackcacert - hostPath: "{{ kube_config_dir }}/openstack-cacert.pem" - mountPath: "{{ kube_config_dir }}/openstack-cacert.pem" -{% endif %} -{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} - - name: cloud-config - hostPath: {{ kube_config_dir }}/cloud_config - mountPath: {{ kube_config_dir }}/cloud_config -{% endif %} {% for volume in controller_manager_extra_volumes %} - name: {{ volume.name }} hostPath: {{ volume.hostPath }} @@ -364,7 +350,7 @@ controllerManager: {% endif %} scheduler: extraArgs: - bind-address: {{ kube_scheduler_bind_address }} + bind-address: "{{ kube_scheduler_bind_address }}" config: {{ kube_config_dir }}/kubescheduler-config.yaml {% if kube_scheduler_feature_gates or kube_feature_gates %} feature-gates: "{{ kube_scheduler_feature_gates | default(kube_feature_gates, true) | join(',') }}" @@ -398,7 +384,7 @@ scheduler: --- apiVersion: kubeproxy.config.k8s.io/v1alpha1 kind: KubeProxyConfiguration -bindAddress: {{ kube_proxy_bind_address }} +bindAddress: "{{ kube_proxy_bind_address }}" clientConnection: acceptContentTypes: {{ kube_proxy_client_accept_content_types }} burst: {{ kube_proxy_client_burst }} @@ -406,7 +392,7 @@ clientConnection: kubeconfig: {{ kube_proxy_client_kubeconfig }} qps: {{ kube_proxy_client_qps }} {% if kube_network_plugin is defined and kube_network_plugin not in ["kube-ovn"] %} -clusterCIDR: "{{ kube_pods_subnet }}{{ ',' + kube_pods_subnet_ipv6 if enable_dual_stack_networks else '' }}" +clusterCIDR: "{{ kube_pods_subnets }}" {% endif %} configSyncPeriod: {{ kube_proxy_config_sync_period }} conntrack: @@ -415,7 +401,7 @@ conntrack: tcpCloseWaitTimeout: {{ kube_proxy_conntrack_tcp_close_wait_timeout }} tcpEstablishedTimeout: {{ kube_proxy_conntrack_tcp_established_timeout }} enableProfiling: {{ kube_proxy_enable_profiling }} -healthzBindAddress: {{ kube_proxy_healthz_bind_address }} +healthzBindAddress: "{{ kube_proxy_healthz_bind_address }}" hostnameOverride: "{{ kube_override_hostname }}" iptables: masqueradeAll: {{ kube_proxy_masquerade_all }} @@ -431,7 +417,7 @@ ipvs: tcpTimeout: {{ kube_proxy_tcp_timeout }} tcpFinTimeout: {{ kube_proxy_tcp_fin_timeout }} udpTimeout: {{ kube_proxy_udp_timeout }} -metricsBindAddress: {{ kube_proxy_metrics_bind_address }} +metricsBindAddress: "{{ kube_proxy_metrics_bind_address }}" mode: {{ kube_proxy_mode }} nodePortAddresses: {{ kube_proxy_nodeport_addresses }} oomScoreAdj: {{ kube_proxy_oom_score_adj }} diff --git a/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2 b/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2 new file mode 100644 index 0000000..ad34040 --- /dev/null +++ b/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta4.yaml.j2 @@ -0,0 +1,593 @@ +apiVersion: kubeadm.k8s.io/v1beta4 +kind: InitConfiguration +{% if kubeadm_token is defined %} +bootstrapTokens: +- token: "{{ kubeadm_token }}" + description: "kubespray kubeadm bootstrap token" + ttl: "24h" +{% endif %} +localAPIEndpoint: + advertiseAddress: "{{ kube_apiserver_address }}" + bindPort: {{ kube_apiserver_port }} +{% if kubeadm_certificate_key is defined %} +certificateKey: {{ kubeadm_certificate_key }} +{% endif %} +nodeRegistration: +{% if kube_override_hostname | default('') %} + name: "{{ kube_override_hostname }}" +{% endif %} +{% if 'kube_control_plane' in group_names and 'kube_node' not in group_names %} + taints: + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane +{% else %} + taints: [] +{% endif %} + criSocket: {{ cri_socket }} +{% if cloud_provider == "external" %} + kubeletExtraArgs: + - name: cloud-provider + value: external +{% endif %} + imagePullPolicy: {{ k8s_image_pull_policy }} + imagePullSerial: {{ kubeadm_image_pull_serial | lower }} +{% if kubeadm_patches | length > 0 %} +patches: + directory: {{ kubeadm_patches_dir }} +{% endif %} +--- +apiVersion: kubeadm.k8s.io/v1beta4 +kind: ClusterConfiguration +clusterName: {{ cluster_name }} +encryptionAlgorithm: {{ kube_asymmetric_encryption_algorithm }} +etcd: +{% if etcd_deployment_type != "kubeadm" %} + external: + endpoints: +{% for endpoint in etcd_access_addresses.split(',') %} + - "{{ endpoint }}" +{% endfor %} + caFile: {{ etcd_cert_dir }}/{{ kube_etcd_cacert_file }} + certFile: {{ etcd_cert_dir }}/{{ kube_etcd_cert_file }} + keyFile: {{ etcd_cert_dir }}/{{ kube_etcd_key_file }} +{% elif etcd_deployment_type == "kubeadm" %} + local: + imageRepository: "{{ etcd_image_repo | regex_replace("/etcd$","") }}" + imageTag: "{{ etcd_image_tag }}" + dataDir: "{{ etcd_data_dir }}" + extraArgs: + - name: metrics + value: {{ etcd_metrics }} + - name: election-timeout + value: "{{ etcd_election_timeout }}" + - name: heartbeat-interval + value: "{{ etcd_heartbeat_interval }}" + - name: auto-compaction-retention + value: "{{ etcd_compaction_retention }}" +{% if etcd_listen_metrics_urls is defined %} + - name: listen-metrics-urls + value: "{{ etcd_listen_metrics_urls }}" +{% endif %} +{% if etcd_snapshot_count is defined %} + - name: snapshot-count + value: "{{ etcd_snapshot_count }}" +{% endif %} +{% if etcd_quota_backend_bytes is defined %} + - name: quota-backend-bytes + value: "{{ etcd_quota_backend_bytes }}" +{% endif %} +{% if etcd_max_request_bytes is defined %} + - name: max-request-bytes + value: "{{ etcd_max_request_bytes }}" +{% endif %} +{% if etcd_log_level is defined %} + - name: log-level + value: "{{ etcd_log_level }}" +{% endif %} +{% for key, value in etcd_extra_vars.items() %} + - name: {{ key }} + value: "{{ value }}" +{% endfor %} + serverCertSANs: +{% for san in etcd_cert_alt_names %} + - "{{ san }}" +{% endfor %} +{% for san in etcd_cert_alt_ips %} + - "{{ san }}" +{% endfor %} + peerCertSANs: +{% for san in etcd_cert_alt_names %} + - "{{ san }}" +{% endfor %} +{% for san in etcd_cert_alt_ips %} + - "{{ san }}" +{% endfor %} +{% endif %} +dns: +{% if 'addon/coredns' in kubeadm_init_phases_skip %} + disabled: true +{% endif %} + imageRepository: {{ coredns_image_repo | regex_replace('/coredns(?!/coredns).*$', '') }} + imageTag: {{ coredns_image_tag }} +networking: + dnsDomain: {{ dns_domain }} + serviceSubnet: "{{ kube_service_subnets }}" +{% if kube_network_plugin is defined and kube_network_plugin not in ["kube-ovn"] %} + podSubnet: "{{ kube_pods_subnets }}" +{% endif %} +{% if kubeadm_feature_gates %} +featureGates: +{% for feature in kubeadm_feature_gates %} + {{ feature | replace("=", ": ") }} +{% endfor %} +{% endif %} +kubernetesVersion: v{{ kube_version }} +{% if kubeadm_config_api_fqdn is defined %} +controlPlaneEndpoint: "{{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}" +{% else %} +controlPlaneEndpoint: "{{ main_ip | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}" +{% endif %} +certificatesDir: {{ kube_cert_dir }} +imageRepository: {{ kube_image_repo }} +apiServer: + extraArgs: +{% if kube_apiserver_etcd_compaction_interval is defined %} + - name: etcd-compaction-interval + value: "{{ kube_apiserver_etcd_compaction_interval }}" +{% endif %} +{% if kube_apiserver_pod_eviction_not_ready_timeout_seconds is defined %} + - name: default-not-ready-toleration-seconds + value: "{{ kube_apiserver_pod_eviction_not_ready_timeout_seconds }}" +{% endif %} +{% if kube_apiserver_pod_eviction_unreachable_timeout_seconds is defined %} + - name: default-unreachable-toleration-seconds + value: "{{ kube_apiserver_pod_eviction_unreachable_timeout_seconds }}" +{% endif %} +{% if kube_api_anonymous_auth is defined %} + - name: anonymous-auth + value: "{{ kube_api_anonymous_auth }}" +{% endif %} +{% if kube_apiserver_use_authorization_config_file %} + - name: authorization-config + value: "{{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml" +{% else %} + - name: authorization-mode + value: "{{ authorization_modes | join(',') }}" +{% endif %} + - name: bind-address + value: "{{ kube_apiserver_bind_address }}" +{% if kube_apiserver_enable_admission_plugins | length > 0 %} + - name: enable-admission-plugins + value: "{{ kube_apiserver_enable_admission_plugins | join(',') }}" +{% endif %} +{% if kube_apiserver_admission_control_config_file %} + - name: admission-control-config-file + value: "{{ kube_config_dir }}/admission-controls.yaml" +{% endif %} +{% if kube_apiserver_disable_admission_plugins | length > 0 %} + - name: disable-admission-plugins + value: "{{ kube_apiserver_disable_admission_plugins | join(',') }}" +{% endif %} + - name: apiserver-count + value: "{{ kube_apiserver_count }}" + - name: endpoint-reconciler-type + value: lease +{% if etcd_events_cluster_enabled %} + - name: etcd-servers-overrides + value: "/events#{{ etcd_events_access_addresses_semicolon }}" +{% endif %} + - name: service-node-port-range + value: "{{ kube_apiserver_node_port_range }}" + - name: service-cluster-ip-range + value: "{{ kube_service_subnets }}" + - name: kubelet-preferred-address-types + value: "{{ kubelet_preferred_address_types }}" + - name: profiling + value: "{{ kube_profiling }}" + - name: request-timeout + value: "{{ kube_apiserver_request_timeout }}" + - name: enable-aggregator-routing + value: "{{ kube_api_aggregator_routing }}" +{% if kube_apiserver_service_account_lookup %} + - name: service-account-lookup + value: "{{ kube_apiserver_service_account_lookup }}" +{% endif %} +{% if kube_oidc_auth | default(false) and kube_oidc_url is defined and kube_oidc_client_id is defined %} + - name: oidc-issuer-url + value: "{{ kube_oidc_url }}" + - name: oidc-client-id + value: "{{ kube_oidc_client_id }}" +{% if kube_oidc_ca_file is defined %} + - name: oidc-ca-file + value: "{{ kube_oidc_ca_file }}" +{% endif %} +{% if kube_oidc_username_claim is defined %} + - name: oidc-username-claim + value: "{{ kube_oidc_username_claim }}" +{% endif %} +{% if kube_oidc_groups_claim is defined %} + - name: oidc-groups-claim + value: "{{ kube_oidc_groups_claim }}" +{% endif %} +{% if kube_oidc_username_prefix is defined %} + - name: oidc-username-prefix + value: "{{ kube_oidc_username_prefix }}" +{% endif %} +{% if kube_oidc_groups_prefix is defined %} + - name: oidc-groups-prefix + value: "{{ kube_oidc_groups_prefix }}" +{% endif %} +{% endif %} +{% if kube_webhook_token_auth | default(false) %} + - name: authentication-token-webhook-config-file + value: "{{ kube_config_dir }}/webhook-token-auth-config.yaml" +{% endif %} +{% if kube_webhook_authorization and not kube_apiserver_use_authorization_config_file %} + - name: authorization-webhook-config-file + value: "{{ kube_config_dir }}/webhook-authorization-config.yaml" +{% endif %} +{% if kube_encrypt_secret_data %} + - name: encryption-provider-config + value: "{{ kube_cert_dir }}/secrets_encryption.yaml" +{% endif %} + - name: storage-backend + value: "{{ kube_apiserver_storage_backend }}" +{% if kube_api_runtime_config | length > 0 %} + - name: runtime-config + value: "{{ kube_api_runtime_config | join(',') }}" +{% endif %} + - name: allow-privileged + value: "true" +{% if kubernetes_audit or kubernetes_audit_webhook %} + - name: audit-policy-file + value: "{{ audit_policy_file }}" +{% endif %} +{% if kubernetes_audit %} + - name: audit-log-path + value: "{{ audit_log_path }}" + - name: audit-log-maxage + value: "{{ audit_log_maxage }}" + - name: audit-log-maxbackup + value: "{{ audit_log_maxbackups }}" + - name: audit-log-maxsize + value: "{{ audit_log_maxsize }}" +{% endif %} +{% if kubernetes_audit_webhook %} + - name: audit-webhook-config-file + value: "{{ audit_webhook_config_file }}" + - name: audit-webhook-mode + value: "{{ audit_webhook_mode }}" +{% if audit_webhook_mode == "batch" %} + - name: audit-webhook-batch-max-size + value: "{{ audit_webhook_batch_max_size }}" + - name: audit-webhook-batch-max-wait + value: "{{ audit_webhook_batch_max_wait }}" +{% endif %} +{% endif %} +{% for key in kube_kubeadm_apiserver_extra_args %} + - name: "{{ key }}" + value: "{{ kube_kubeadm_apiserver_extra_args[key] }}" +{% endfor %} +{% if kube_apiserver_feature_gates or kube_feature_gates %} + - name: feature-gates + value: "{{ kube_apiserver_feature_gates | default(kube_feature_gates, true) | join(',') }}" +{% endif %} +{% if tls_min_version is defined %} + - name: tls-min-version + value: "{{ tls_min_version }}" +{% endif %} +{% if tls_cipher_suites is defined %} + - name: tls-cipher-suites + value: "{% for tls in tls_cipher_suites %}{{ tls }}{{ ',' if not loop.last else '' }}{% endfor %}" +{% endif %} +{% if event_ttl_duration is defined %} + - name: event-ttl + value: "{{ event_ttl_duration }}" +{% endif %} +{% if kubelet_rotate_server_certificates %} + - name: kubelet-certificate-authority + value: "{{ kube_cert_dir }}/ca.crt" +{% endif %} +{% if kube_apiserver_tracing %} + - name: tracing-config-file + value: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml" +{% endif %} +{% if kubernetes_audit or kube_token_auth or kube_webhook_token_auth or apiserver_extra_volumes or ssl_ca_dirs | length %} + extraVolumes: +{% if kube_token_auth %} + - name: token-auth-config + hostPath: {{ kube_token_dir }} + mountPath: {{ kube_token_dir }} +{% endif %} +{% if kube_webhook_token_auth | default(false) %} + - name: webhook-token-auth-config + hostPath: {{ kube_config_dir }}/webhook-token-auth-config.yaml + mountPath: {{ kube_config_dir }}/webhook-token-auth-config.yaml +{% endif %} +{% if kube_webhook_authorization | default(false) %} + - name: webhook-authorization-config + hostPath: {{ kube_config_dir }}/webhook-authorization-config.yaml + mountPath: {{ kube_config_dir }}/webhook-authorization-config.yaml +{% endif %} +{% if kube_apiserver_use_authorization_config_file %} + - name: authorization-config + hostPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml + mountPath: {{ kube_config_dir }}/apiserver-authorization-config-{{ kube_apiserver_authorization_config_api_version }}.yaml +{% endif %} +{% if kubernetes_audit or kubernetes_audit_webhook %} + - name: {{ audit_policy_name }} + hostPath: {{ audit_policy_hostpath }} + mountPath: {{ audit_policy_mountpath }} +{% if audit_log_path != "-" %} + - name: {{ audit_log_name }} + hostPath: {{ audit_log_hostpath }} + mountPath: {{ audit_log_mountpath }} + readOnly: false +{% endif %} +{% endif %} +{% if kube_apiserver_admission_control_config_file %} + - name: admission-control-configs + hostPath: {{ kube_config_dir }}/admission-controls + mountPath: {{ kube_config_dir }} + readOnly: false + pathType: DirectoryOrCreate +{% endif %} +{% if kube_apiserver_tracing %} + - name: tracing + hostPath: {{ kube_config_dir }}/tracing + mountPath: {{ kube_config_dir }}/tracing + readOnly: true + pathType: DirectoryOrCreate +{% endif %} +{% for volume in apiserver_extra_volumes %} + - name: {{ volume.name }} + hostPath: {{ volume.hostPath }} + mountPath: {{ volume.mountPath }} + readOnly: {{ volume.readOnly | d(not (volume.writable | d(false))) }} +{% endfor %} +{% if ssl_ca_dirs | length %} +{% for dir in ssl_ca_dirs %} + - name: {{ dir | regex_replace('^/(.*)$', '\\1' ) | regex_replace('/', '-') }} + hostPath: {{ dir }} + mountPath: {{ dir }} + readOnly: true +{% endfor %} +{% endif %} +{% endif %} + certSANs: +{% for san in apiserver_sans %} + - {{ san }} +{% endfor %} +controllerManager: + extraArgs: + - name: node-monitor-grace-period + value: "{{ kube_controller_node_monitor_grace_period }}" + - name: node-monitor-period + value: "{{ kube_controller_node_monitor_period }}" +{% if kube_network_plugin is defined and kube_network_plugin not in ["kube-ovn"] %} + - name: cluster-cidr + value: "{{ kube_pods_subnets }}" +{% endif %} + - name: service-cluster-ip-range + value: "{{ kube_service_subnets }}" +{% if kube_network_plugin is defined and kube_network_plugin == "calico" and not calico_ipam_host_local %} + - name: allocate-node-cidrs + value: "false" +{% else %} +{% if ipv4_stack %} + - name: node-cidr-mask-size-ipv4 + value: "{{ kube_network_node_prefix }}" +{% endif %} +{% if ipv6_stack %} + - name: node-cidr-mask-size-ipv6 + value: "{{ kube_network_node_prefix_ipv6 }}" +{% endif %} +{% endif %} + - name: profiling + value: "{{ kube_profiling }}" + - name: terminated-pod-gc-threshold + value: "{{ kube_controller_terminated_pod_gc_threshold }}" + - name: bind-address + value: "{{ kube_controller_manager_bind_address }}" + - name: leader-elect-lease-duration + value: "{{ kube_controller_manager_leader_elect_lease_duration }}" + - name: leader-elect-renew-deadline + value: "{{ kube_controller_manager_leader_elect_renew_deadline }}" +{% if kube_controller_feature_gates or kube_feature_gates %} + - name: feature-gates + value: "{{ kube_controller_feature_gates | default(kube_feature_gates, true) | join(',') }}" +{% endif %} +{% for key in kube_kubeadm_controller_extra_args %} + - name: "{{ key }}" + value: "{{ kube_kubeadm_controller_extra_args[key] }}" +{% endfor %} +{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} + - name: cloud-provider + value: "{{ cloud_provider }}" + - name: cloud-config + value: "{{ kube_config_dir }}/cloud_config" +{% endif %} +{% if kube_network_plugin is defined and kube_network_plugin not in ["cloud"] %} + - name: configure-cloud-routes + value: "false" +{% endif %} +{% if kubelet_flexvolumes_plugins_dir is defined %} + - name: flex-volume-plugin-dir + value: "{{ kubelet_flexvolumes_plugins_dir }}" +{% endif %} +{% if tls_min_version is defined %} + - name: tls-min-version + value: "{{ tls_min_version }}" +{% endif %} +{% if tls_cipher_suites is defined %} + - name: tls-cipher-suites + value: "{% for tls in tls_cipher_suites %}{{ tls }}{{ ',' if not loop.last else '' }}{% endfor %}" +{% endif %} +{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] or controller_manager_extra_volumes %} + extraVolumes: +{% if cloud_provider is defined and cloud_provider in ["openstack"] and openstack_cacert is defined %} + - name: openstackcacert + hostPath: "{{ kube_config_dir }}/openstack-cacert.pem" + mountPath: "{{ kube_config_dir }}/openstack-cacert.pem" +{% endif %} +{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} + - name: cloud-config + hostPath: {{ kube_config_dir }}/cloud_config + mountPath: {{ kube_config_dir }}/cloud_config +{% endif %} +{% for volume in controller_manager_extra_volumes %} + - name: {{ volume.name }} + hostPath: {{ volume.hostPath }} + mountPath: {{ volume.mountPath }} + readOnly: {{ volume.readOnly | d(not (volume.writable | d(false))) }} +{% endfor %} +{% endif %} +scheduler: + extraArgs: + - name: bind-address + value: "{{ kube_scheduler_bind_address }}" + - name: config + value: "{{ kube_config_dir }}/kubescheduler-config.yaml" +{% if kube_scheduler_feature_gates or kube_feature_gates %} + - name: feature-gates + value: "{{ kube_scheduler_feature_gates | default(kube_feature_gates, true) | join(',') }}" +{% endif %} + - name: profiling + value: "{{ kube_profiling }}" +{% if kube_kubeadm_scheduler_extra_args | length > 0 %} +{% for key in kube_kubeadm_scheduler_extra_args %} + - name: "{{ key }}" + value: "{{ kube_kubeadm_scheduler_extra_args[key] }}" +{% endfor %} +{% endif %} +{% if tls_min_version is defined %} + - name: tls-min-version + value: "{{ tls_min_version }}" +{% endif %} +{% if tls_cipher_suites is defined %} + - name: tls-cipher-suites + value: "{% for tls in tls_cipher_suites %}{{ tls }}{{ ',' if not loop.last else '' }}{% endfor %}" +{% endif %} + extraVolumes: + - name: kubescheduler-config + hostPath: {{ kube_config_dir }}/kubescheduler-config.yaml + mountPath: {{ kube_config_dir }}/kubescheduler-config.yaml + readOnly: true +{% if scheduler_extra_volumes %} +{% for volume in scheduler_extra_volumes %} + - name: {{ volume.name }} + hostPath: {{ volume.hostPath }} + mountPath: {{ volume.mountPath }} + readOnly: {{ volume.readOnly | d(not (volume.writable | d(false))) }} +{% endfor %} +{% endif %} +--- +apiVersion: kubeadm.k8s.io/v1beta4 +kind: UpgradeConfiguration +apply: + kubernetesVersion: v{{ kube_version }} + allowExperimentalUpgrades: true + certificateRenewal: {{ kubeadm_upgrade_auto_cert_renewal | lower }} + etcdUpgrade: {{ (etcd_deployment_type == "kubeadm") | lower }} + forceUpgrade: true +{% if kubeadm_ignore_preflight_errors | length > 0 %} + ignorePreflightErrors: +{% for ignore_error in kubeadm_ignore_preflight_errors %} + - "{{ ignore_error }}" +{% endfor %} +{% endif %} +{% if kubeadm_patches | length > 0 %} + patches: + directory: {{ kubeadm_patches_dir }} +{% endif %} + imagePullPolicy: {{ k8s_image_pull_policy }} + imagePullSerial: {{ kubeadm_image_pull_serial | lower }} +node: + certificateRenewal: {{ kubeadm_upgrade_auto_cert_renewal | lower }} + etcdUpgrade: {{ (etcd_deployment_type == "kubeadm") | lower }} +{% if kubeadm_ignore_preflight_errors | length > 0 %} + ignorePreflightErrors: +{% for ignore_error in kubeadm_ignore_preflight_errors %} + - "{{ ignore_error }}" +{% endfor %} +{% endif %} +{% if kubeadm_patches | length > 0 %} + patches: + directory: {{ kubeadm_patches_dir }} +{% endif %} + imagePullPolicy: {{ k8s_image_pull_policy }} + imagePullSerial: {{ kubeadm_image_pull_serial | lower }} +--- +apiVersion: kubeproxy.config.k8s.io/v1alpha1 +kind: KubeProxyConfiguration +bindAddress: "{{ kube_proxy_bind_address }}" +clientConnection: + acceptContentTypes: {{ kube_proxy_client_accept_content_types }} + burst: {{ kube_proxy_client_burst }} + contentType: {{ kube_proxy_client_content_type }} + kubeconfig: {{ kube_proxy_client_kubeconfig }} + qps: {{ kube_proxy_client_qps }} +{% if kube_network_plugin is defined and kube_network_plugin not in ["kube-ovn"] %} +clusterCIDR: "{{ kube_pods_subnets }}" +{% endif %} +configSyncPeriod: {{ kube_proxy_config_sync_period }} +conntrack: + maxPerCore: {{ kube_proxy_conntrack_max_per_core }} + min: {{ kube_proxy_conntrack_min }} + tcpCloseWaitTimeout: {{ kube_proxy_conntrack_tcp_close_wait_timeout }} + tcpEstablishedTimeout: {{ kube_proxy_conntrack_tcp_established_timeout }} +enableProfiling: {{ kube_proxy_enable_profiling }} +healthzBindAddress: "{{ kube_proxy_healthz_bind_address }}" +hostnameOverride: "{{ kube_override_hostname }}" +iptables: + masqueradeAll: {{ kube_proxy_masquerade_all }} + masqueradeBit: {{ kube_proxy_masquerade_bit }} + minSyncPeriod: {{ kube_proxy_min_sync_period }} + syncPeriod: {{ kube_proxy_sync_period }} +ipvs: + excludeCIDRs: {{ kube_proxy_exclude_cidrs }} + minSyncPeriod: {{ kube_proxy_min_sync_period }} + scheduler: {{ kube_proxy_scheduler }} + syncPeriod: {{ kube_proxy_sync_period }} + strictARP: {{ kube_proxy_strict_arp }} + tcpTimeout: {{ kube_proxy_tcp_timeout }} + tcpFinTimeout: {{ kube_proxy_tcp_fin_timeout }} + udpTimeout: {{ kube_proxy_udp_timeout }} +metricsBindAddress: "{{ kube_proxy_metrics_bind_address }}" +mode: {{ kube_proxy_mode }} +nodePortAddresses: {{ kube_proxy_nodeport_addresses }} +oomScoreAdj: {{ kube_proxy_oom_score_adj }} +portRange: {{ kube_proxy_port_range }} +{% if kube_proxy_feature_gates or kube_feature_gates %} +{% set feature_gates = ( kube_proxy_feature_gates | default(kube_feature_gates, true) ) %} +featureGates: +{% for feature in feature_gates %} + {{ feature | replace("=", ": ") }} +{% endfor %} +{% endif %} +{# DNS settings for kubelet #} +{% if enable_nodelocaldns %} +{% set kubelet_cluster_dns = [nodelocaldns_ip] %} +{% elif dns_mode in ['coredns'] %} +{% set kubelet_cluster_dns = [skydns_server] %} +{% elif dns_mode == 'coredns_dual' %} +{% set kubelet_cluster_dns = [skydns_server,skydns_server_secondary] %} +{% elif dns_mode == 'manual' %} +{% set kubelet_cluster_dns = [manual_dns_server] %} +{% else %} +{% set kubelet_cluster_dns = [] %} +{% endif %} +--- +apiVersion: kubelet.config.k8s.io/v1beta1 +kind: KubeletConfiguration +clusterDNS: +{% for dns_address in kubelet_cluster_dns %} +- {{ dns_address }} +{% endfor %} +{% if kubelet_feature_gates or kube_feature_gates %} +{% set feature_gates = ( kubelet_feature_gates | default(kube_feature_gates, true) ) %} +featureGates: +{% for feature in feature_gates %} + {{ feature | replace("=", ": ") }} +{% endfor %} +{% endif %} diff --git a/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-controlplane.v1beta3.yaml.j2 b/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-controlplane.yaml.j2 similarity index 64% rename from kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-controlplane.v1beta3.yaml.j2 rename to kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-controlplane.yaml.j2 index cd19b5c..a8e7d32 100644 --- a/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-controlplane.v1beta3.yaml.j2 +++ b/kubespray/project/roles/kubernetes/control-plane/templates/kubeadm-controlplane.yaml.j2 @@ -1,4 +1,4 @@ -apiVersion: kubeadm.k8s.io/v1beta3 +apiVersion: kubeadm.k8s.io/{{ kubeadm_config_api_version }} kind: JoinConfiguration discovery: {% if kubeadm_use_file_discovery %} @@ -9,29 +9,35 @@ discovery: {% if kubeadm_config_api_fqdn is defined %} apiServerEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }} {% else %} - apiServerEndpoint: {{ kubeadm_discovery_address }} + apiServerEndpoint: "{{ kubeadm_discovery_address }}" {% endif %} token: {{ kubeadm_token }} unsafeSkipCAVerification: true {% endif %} - timeout: {{ discovery_timeout }} tlsBootstrapToken: {{ kubeadm_token }} +{# TODO: drop the if when we drop support for k8s<1.31 #} +{% if kubeadm_config_api_version == 'v1beta3' %} + timeout: {{ discovery_timeout }} +{% else %} +timeouts: + discovery: {{ discovery_timeout }} +{% endif %} controlPlane: localAPIEndpoint: - advertiseAddress: {{ kube_apiserver_address }} + advertiseAddress: "{{ kube_apiserver_address }}" bindPort: {{ kube_apiserver_port }} certificateKey: {{ kubeadm_certificate_key }} nodeRegistration: name: {{ kube_override_hostname | default(inventory_hostname) }} criSocket: {{ cri_socket }} -{% if inventory_hostname in groups['kube_control_plane'] and inventory_hostname not in groups['kube_node'] %} +{% if 'kube_control_plane' in group_names and 'kube_node' not in group_names %} taints: - effect: NoSchedule key: node-role.kubernetes.io/control-plane {% else %} taints: [] {% endif %} -{% if kubeadm_patches is defined and kubeadm_patches.enabled %} +{% if kubeadm_patches | length > 0 %} patches: - directory: {{ kubeadm_patches.dest_dir }} + directory: {{ kubeadm_patches_dir }} {% endif %} diff --git a/kubespray/project/roles/kubernetes/control-plane/templates/resourcequota.yaml.j2 b/kubespray/project/roles/kubernetes/control-plane/templates/resourcequota.yaml.j2 new file mode 100644 index 0000000..ceec251 --- /dev/null +++ b/kubespray/project/roles/kubernetes/control-plane/templates/resourcequota.yaml.j2 @@ -0,0 +1,8 @@ +apiVersion: apiserver.config.k8s.io/v1 +kind: ResourceQuotaConfiguration +{% if kube_resource_quota_limited_resources | d(false) -%} +limitedResources: +{{ kube_resource_quota_limited_resources | to_nice_yaml(indent=2, sort_keys=false) }} +{% else %} +# No limitedResources configured. If limitedResources are required, please set kube_resource_quota_limited_resources. +{%- endif %} diff --git a/kubespray/project/roles/kubernetes/control-plane/vars/main.yaml b/kubespray/project/roles/kubernetes/control-plane/vars/main.yaml index f888d6b..263ee0b 100644 --- a/kubespray/project/roles/kubernetes/control-plane/vars/main.yaml +++ b/kubespray/project/roles/kubernetes/control-plane/vars/main.yaml @@ -1,3 +1,9 @@ --- # list of admission plugins that needs to be configured -kube_apiserver_admission_plugins_needs_configuration: [EventRateLimit, PodSecurity] +# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/ +kube_apiserver_admission_plugins_needs_configuration: +- EventRateLimit +- ImagePolicyWebhook +- PodSecurity +- PodNodeSelector +- ResourceQuota diff --git a/kubespray/project/roles/kubernetes/kubeadm/defaults/main.yml b/kubespray/project/roles/kubernetes/kubeadm/defaults/main.yml index 5047de5..8f51119 100644 --- a/kubespray/project/roles/kubernetes/kubeadm/defaults/main.yml +++ b/kubespray/project/roles/kubernetes/kubeadm/defaults/main.yml @@ -6,10 +6,3 @@ kubeadm_join_timeout: 120s # Enable kubeadm file discovery if anonymous access has been removed kubeadm_use_file_discovery: "{{ remove_anonymous_access }}" - -# If non-empty, will use this string as identification instead of the actual hostname -kube_override_hostname: >- - {%- if cloud_provider is defined and cloud_provider in ['aws'] -%} - {%- else -%} - {{ inventory_hostname }} - {%- endif -%} diff --git a/kubespray/project/roles/kubernetes/kubeadm/meta/main.yml b/kubespray/project/roles/kubernetes/kubeadm/meta/main.yml new file mode 100644 index 0000000..4e72785 --- /dev/null +++ b/kubespray/project/roles/kubernetes/kubeadm/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: kubernetes/kubeadm_common diff --git a/kubespray/project/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml b/kubespray/project/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml index 13420c0..21ecf7f 100644 --- a/kubespray/project/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml +++ b/kubespray/project/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml @@ -6,9 +6,10 @@ - name: Create kubeadm cert controlplane config template: - src: "kubeadm-client.conf.{{ kubeadmConfig_api_version }}.j2" + src: "kubeadm-client.conf.j2" dest: "{{ kube_config_dir }}/kubeadm-cert-controlplane.conf" mode: "0640" + validate: "{{ kubeadm_config_validate_enabled | ternary(bin_dir + '/kubeadm config validate --config %s', omit) }}" vars: kubeadm_cert_controlplane: true @@ -51,7 +52,7 @@ register: "etcd_client_cert_serial_result" changed_when: false when: - - inventory_hostname in groups['k8s_cluster'] | union(groups['calico_rr'] | default([])) | unique | sort + - group_names | intersect(['k8s_cluster', 'calico_rr']) | length > 0 tags: - network diff --git a/kubespray/project/roles/kubernetes/kubeadm/tasks/main.yml b/kubespray/project/roles/kubernetes/kubeadm/tasks/main.yml index ad6ac36..c140ccb 100644 --- a/kubespray/project/roles/kubernetes/kubeadm/tasks/main.yml +++ b/kubespray/project/roles/kubernetes/kubeadm/tasks/main.yml @@ -4,7 +4,7 @@ # noqa: jinja[spacing] kubeadm_discovery_address: >- {%- if "127.0.0.1" in kube_apiserver_endpoint or "localhost" in kube_apiserver_endpoint -%} - {{ first_kube_control_plane_address }}:{{ kube_apiserver_port }} + {{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} {%- else -%} {{ kube_apiserver_endpoint | replace("https://", "") }} {%- endif %} @@ -29,17 +29,15 @@ delegate_to: "{{ groups['kube_control_plane'][0] }}" run_once: true -- name: Calculate kubeadm CA cert hash - shell: set -o pipefail && openssl x509 -pubkey -in {{ kube_cert_dir }}/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //' - args: - executable: /bin/bash - register: kubeadm_ca_hash +- name: Fetch CA certificate from control plane node + slurp: + src: "{{ kube_cert_dir }}/ca.crt" + register: ca_cert_content when: - kubeadm_ca_stat.stat is defined - kubeadm_ca_stat.stat.exists delegate_to: "{{ groups['kube_control_plane'][0] }}" run_once: true - changed_when: false - name: Create kubeadm token for joining nodes with 24h expiration (default) command: "{{ bin_dir }}/kubeadm token create" @@ -53,10 +51,6 @@ kubeadm_token: "{{ temp_token.stdout }}" when: kubeadm_token is not defined -- name: Set kubeadm api version to v1beta3 - set_fact: - kubeadmConfig_api_version: v1beta3 - - name: Get kubeconfig for join discovery process command: "{{ kubectl }} -n kube-public get cm cluster-info -o jsonpath='{.data.kubeconfig}'" register: kubeconfig_file_discovery @@ -71,69 +65,35 @@ owner: "root" mode: "0644" when: - - not is_kube_master + - ('kube_control_plane' not in group_names) - not kubelet_conf.stat.exists - kubeadm_use_file_discovery - name: Create kubeadm client config template: - src: "kubeadm-client.conf.{{ kubeadmConfig_api_version }}.j2" + src: "kubeadm-client.conf.j2" dest: "{{ kube_config_dir }}/kubeadm-client.conf" backup: true mode: "0640" - when: not is_kube_master - -- name: Kubeadm | Create directory to store kubeadm patches - file: - path: "{{ kubeadm_patches.dest_dir }}" - state: directory - mode: "0640" - when: kubeadm_patches is defined and kubeadm_patches.enabled - -- name: Kubeadm | Copy kubeadm patches from inventory files - copy: - src: "{{ kubeadm_patches.source_dir }}/" - dest: "{{ kubeadm_patches.dest_dir }}" - owner: "root" - mode: "0644" - when: kubeadm_patches is defined and kubeadm_patches.enabled + validate: "{{ kubeadm_config_validate_enabled | ternary(bin_dir + '/kubeadm config validate --config %s', omit) }}" + when: ('kube_control_plane' not in group_names) - name: Join to cluster if needed environment: PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}:/sbin" - when: not is_kube_master and (not kubelet_conf.stat.exists) - block: - - - name: Join to cluster - command: >- - timeout -k {{ kubeadm_join_timeout }} {{ kubeadm_join_timeout }} - {{ bin_dir }}/kubeadm join - --config {{ kube_config_dir }}/kubeadm-client.conf - --ignore-preflight-errors=DirAvailable--etc-kubernetes-manifests - --skip-phases={{ kubeadm_join_phases_skip | join(',') }} - register: kubeadm_join - changed_when: kubeadm_join is success - - rescue: - - - name: Join to cluster with ignores - command: >- - timeout -k {{ kubeadm_join_timeout }} {{ kubeadm_join_timeout }} - {{ bin_dir }}/kubeadm join - --config {{ kube_config_dir }}/kubeadm-client.conf - --ignore-preflight-errors=all - --skip-phases={{ kubeadm_join_phases_skip | join(',') }} - register: kubeadm_join - changed_when: kubeadm_join is success - - always: - - - name: Display kubeadm join stderr if any - when: kubeadm_join is failed - debug: - msg: | - Joined with warnings - {{ kubeadm_join.stderr_lines }} + when: + - ('kube_control_plane' not in group_names) + - not kubelet_conf.stat.exists + vars: + ignored: + - DirAvailable--etc-kubernetes-manifests + - "{{ kubeadm_ignore_preflight_errors }}" + command: >- + timeout -k {{ kubeadm_join_timeout }} {{ kubeadm_join_timeout }} + {{ bin_dir }}/kubeadm join + --config {{ kube_config_dir }}/kubeadm-client.conf + --ignore-preflight-errors={{ ignored | flatten | join(',') }} + --skip-phases={{ kubeadm_join_phases_skip | join(',') }} - name: Update server field in kubelet kubeconfig lineinfile: @@ -143,7 +103,7 @@ backup: true when: - kubeadm_config_api_fqdn is not defined - - not is_kube_master + - ('kube_control_plane' not in group_names) - kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "") notify: Kubeadm | restart kubelet @@ -154,7 +114,7 @@ line: ' server: {{ kube_apiserver_endpoint }}' backup: true when: - - not is_kube_master + - ('kube_control_plane' not in group_names) - loadbalancer_apiserver is defined notify: Kubeadm | restart kubelet @@ -169,8 +129,8 @@ tags: - kube-proxy -# FIXME(mattymo): Need to point to localhost, otherwise masters will all point -# incorrectly to first master, creating SPoF. +# FIXME(mattymo): Need to point to localhost, otherwise control plane nodes will all point +# incorrectly to first control plane node, creating SPoF. - name: Update server field in kube-proxy kubeconfig shell: >- set -o pipefail && {{ kubectl }} get configmap kube-proxy -n kube-system -o yaml @@ -241,5 +201,5 @@ when: - etcd_deployment_type == "kubeadm" - inventory_hostname not in groups['kube_control_plane'] - - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally - kube_network_plugin != "calico" or calico_datastore == "etcd" diff --git a/kubespray/project/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.v1beta3.j2 b/kubespray/project/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.j2 similarity index 57% rename from kubespray/project/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.v1beta3.j2 rename to kubespray/project/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.j2 index 3b3bc57..e2e450b 100644 --- a/kubespray/project/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.v1beta3.j2 +++ b/kubespray/project/roles/kubernetes/kubeadm/templates/kubeadm-client.conf.j2 @@ -1,5 +1,5 @@ --- -apiVersion: kubeadm.k8s.io/v1beta3 +apiVersion: kubeadm.k8s.io/{{ kubeadm_config_api_version }} kind: JoinConfiguration discovery: {% if kubeadm_use_file_discovery %} @@ -8,25 +8,31 @@ discovery: {% else %} bootstrapToken: {% if kubeadm_config_api_fqdn is defined %} - apiServerEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }} + apiServerEndpoint: "{{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}" {% else %} - apiServerEndpoint: {{ kubeadm_discovery_address }} + apiServerEndpoint: "{{ kubeadm_discovery_address }}" {% endif %} token: {{ kubeadm_token }} -{% if kubeadm_ca_hash.stdout is defined %} +{% if ca_cert_content is defined %} caCertHashes: - - sha256:{{ kubeadm_ca_hash.stdout }} + - sha256:{{ (ca_cert_content.content | b64decode | community.crypto.x509_certificate_info).public_key_fingerprints.sha256.replace(':', '') }} {% else %} unsafeSkipCAVerification: true {% endif %} {% endif %} - timeout: {{ discovery_timeout }} tlsBootstrapToken: {{ kubeadm_token }} +{# TODO: drop the if when we drop support for k8s<1.31 #} +{% if kubeadm_config_api_version == 'v1beta3' %} + timeout: {{ discovery_timeout }} +{% else %} +timeouts: + discovery: {{ discovery_timeout }} +{% endif %} caCertPath: {{ kube_cert_dir }}/ca.crt {% if kubeadm_cert_controlplane is defined and kubeadm_cert_controlplane %} controlPlane: localAPIEndpoint: - advertiseAddress: {{ kube_apiserver_address }} + advertiseAddress: "{{ kube_apiserver_address }}" bindPort: {{ kube_apiserver_port }} certificateKey: {{ kubeadm_certificate_key }} {% endif %} @@ -38,7 +44,7 @@ nodeRegistration: - effect: NoSchedule key: node-role.kubernetes.io/calico-rr {% endif %} -{% if kubeadm_patches is defined and kubeadm_patches.enabled %} +{% if kubeadm_patches | length > 0 %} patches: - directory: {{ kubeadm_patches.dest_dir }} + directory: {{ kubeadm_patches_dir }} {% endif %} diff --git a/kubespray/project/roles/kubernetes/kubeadm_common/defaults/main.yml b/kubespray/project/roles/kubernetes/kubeadm_common/defaults/main.yml new file mode 100644 index 0000000..7051f73 --- /dev/null +++ b/kubespray/project/roles/kubernetes/kubeadm_common/defaults/main.yml @@ -0,0 +1,23 @@ +--- +kubeadm_patches_dir: "{{ kube_config_dir }}/patches" +kubeadm_patches: [] +# See https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/control-plane-flags/#patches +# Correspondance with this link +# patchtype = type +# target = target +# suffix -> managed automatically +# extension -> always "yaml" +# kubeadm_patches: +# - target: kube-apiserver|kube-controller-manager|kube-scheduler|etcd|kubeletconfiguration +# type: strategic(default)|json|merge +# patch: +# metadata: +# annotations: +# example.com/test: "true" +# labels: +# example.com/prod_level: "{{ prod_level }}" +# - ... +# Patches are applied in the order they are specified. + +# List of errors to ignore during kubeadm preflight checks +kubeadm_ignore_preflight_errors: [] diff --git a/kubespray/project/roles/kubernetes/kubeadm_common/tasks/main.yml b/kubespray/project/roles/kubernetes/kubeadm_common/tasks/main.yml new file mode 100644 index 0000000..0f8d3b0 --- /dev/null +++ b/kubespray/project/roles/kubernetes/kubeadm_common/tasks/main.yml @@ -0,0 +1,17 @@ +--- +- name: Kubeadm | Create directory to store kubeadm patches + file: + path: "{{ kubeadm_patches_dir }}" + state: directory + mode: "0640" + when: kubeadm_patches | length > 0 + +- name: Kubeadm | Copy kubeadm patches from inventory files + copy: + content: "{{ item.patch | to_yaml }}" + dest: "{{ kubeadm_patches_dir }}/{{ item.target }}{{ suffix }}+{{ item.type | d('strategic') }}.yaml" + owner: "root" + mode: "0644" + loop: "{{ kubeadm_patches }}" + loop_control: + index_var: suffix diff --git a/kubespray/project/roles/kubernetes/node/defaults/main.yml b/kubespray/project/roles/kubernetes/node/defaults/main.yml index 6c60c72..5af9c0b 100644 --- a/kubespray/project/roles/kubernetes/node/defaults/main.yml +++ b/kubespray/project/roles/kubernetes/node/defaults/main.yml @@ -1,15 +1,16 @@ --- # advertised host IP for kubelet. This affects network plugin config. Take caution -kubelet_address: "{{ ip | default(fallback_ips[inventory_hostname]) }}{{ (',' + ip6) if enable_dual_stack_networks and ip6 is defined else '' }}" +# add ipv6 manual for dualstack mode because ipv4 priority in main_ip for dualstack +kubelet_address: "{{ main_ips | join(',') }}" -# bind address for kubelet. Set to 0.0.0.0 to listen on all interfaces -kubelet_bind_address: "{{ ip | default('0.0.0.0') }}" +# bind address for kubelet. Set to :: to listen on all interfaces +kubelet_bind_address: "{{ main_ip | default('::') }}" # resolv.conf to base dns config kube_resolv_conf: "/etc/resolv.conf" # Set to empty to avoid cgroup creation -kubelet_enforce_node_allocatable: '""' +kubelet_enforce_node_allocatable: "\"\"" # Set runtime and kubelet cgroups when using systemd as cgroup driver (default) kube_service_cgroups: "{% if kube_reserved %}{{ kube_reserved_cgroups_for_service_slice }}{% else %}system.slice{% endif %}" @@ -27,39 +28,30 @@ kubelet_systemd_hardening: false kubelet_systemd_wants_dependencies: [] # List of secure IPs for kubelet +# don't forget ipv6 addresses for dualstack(because "main_ip" prioritizes ipv4) kube_node_addresses: >- - {%- for host in (groups['kube_control_plane'] + groups['kube_node'] + groups['etcd']) | unique -%} - {{ hostvars[host]['ip'] | default(fallback_ips[host]) }}{{ ' ' if not loop.last else '' }} + {%- for host in (groups['k8s_cluster'] | union(groups['etcd'])) -%} + {{ hostvars[host]['main_ips'] | join(' ') }}{{ ' ' if not loop.last else '' }} {%- endfor -%} -kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnet }} {{ kube_node_addresses }}" +kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnets | regex_replace(',', ' ') }} {{ kube_node_addresses }}" + # Reserve this space for kube resources # Whether to run kubelet and container-engine daemons in a dedicated cgroup. (Not required for resource reservations). kube_reserved: false -kube_reserved_cgroups_for_service_slice: kube.slice kube_reserved_cgroups: "/{{ kube_reserved_cgroups_for_service_slice }}" -kube_memory_reserved: 256Mi -kube_cpu_reserved: 100m -# kube_ephemeral_storage_reserved: 2Gi -# kube_pid_reserved: "1000" -# Reservation for master hosts -kube_master_memory_reserved: 512Mi -kube_master_cpu_reserved: 200m -# kube_master_ephemeral_storage_reserved: 2Gi -# kube_master_pid_reserved: "1000" +kube_memory_reserved: "256Mi" +kube_cpu_reserved: "100m" +kube_ephemeral_storage_reserved: "500Mi" +kube_pid_reserved: "1000" # Set to true to reserve resources for system daemons system_reserved: false system_reserved_cgroups_for_service_slice: system.slice system_reserved_cgroups: "/{{ system_reserved_cgroups_for_service_slice }}" -system_memory_reserved: 512Mi -system_cpu_reserved: 500m -# system_ephemeral_storage_reserved: 2Gi -# system_pid_reserved: "1000" -# Reservation for master hosts -system_master_memory_reserved: 256Mi -system_master_cpu_reserved: 250m -# system_master_ephemeral_storage_reserved: 2Gi -# system_master_pid_reserved: "1000" +system_memory_reserved: "512Mi" +system_cpu_reserved: "500m" +system_ephemeral_storage_reserved: "500Mi" +system_pid_reserved: 1000 ## Eviction Thresholds to avoid system OOMs # https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds @@ -69,7 +61,7 @@ eviction_hard_control_plane: {} kubelet_status_update_frequency: 10s # kube-vip -kube_vip_version: v0.8.0 +kube_vip_version: 0.8.0 kube_vip_arp_enabled: false kube_vip_interface: @@ -91,7 +83,6 @@ kube_vip_bgppeers: kube_vip_address: kube_vip_enableServicesElection: false kube_vip_lb_enable: false -kube_vip_lb_fwdmethod: local kube_vip_leasename: plndr-cp-lock kube_vip_svc_leasename: plndr-svcs-lock kube_vip_leaseduration: 5 @@ -135,9 +126,6 @@ kubelet_config_extra_args_cgroupfs: systemCgroups: /system.slice cgroupRoot: / -## Support parameters to be passed to kubelet via kubelet-config.yaml only on nodes, not masters -kubelet_node_config_extra_args: {} - # Maximum number of container log files that can be present for a container. kubelet_logfiles_max_nr: 5 @@ -147,16 +135,6 @@ kubelet_logfiles_max_size: 10Mi ## Support custom flags to be passed to kubelet kubelet_custom_flags: [] -## Support custom flags to be passed to kubelet only on nodes, not masters -kubelet_node_custom_flags: [] - -# If non-empty, will use this string as identification instead of the actual hostname -kube_override_hostname: >- - {%- if cloud_provider is defined and cloud_provider in ['aws'] -%} - {%- else -%} - {{ inventory_hostname }} - {%- endif -%} - # The read-only port for the Kubelet to serve on with no authentication/authorization. kube_read_only_port: 0 @@ -169,61 +147,6 @@ kubelet_healthz_bind_address: 127.0.0.1 # sysctl_file_path to add sysctl conf to sysctl_file_path: "/etc/sysctl.d/99-sysctl.conf" -# For the openstack integration kubelet will need credentials to access -# openstack apis like nova and cinder. Per default this values will be -# read from the environment. -openstack_auth_url: "{{ lookup('env', 'OS_AUTH_URL') }}" -openstack_username: "{{ lookup('env', 'OS_USERNAME') }}" -openstack_password: "{{ lookup('env', 'OS_PASSWORD') }}" -openstack_region: "{{ lookup('env', 'OS_REGION_NAME') }}" -openstack_tenant_id: "{{ lookup('env', 'OS_TENANT_ID') | default(lookup('env', 'OS_PROJECT_ID') | default(lookup('env', 'OS_PROJECT_NAME'), true), true) }}" -openstack_tenant_name: "{{ lookup('env', 'OS_TENANT_NAME') }}" -openstack_domain_name: "{{ lookup('env', 'OS_USER_DOMAIN_NAME') }}" -openstack_domain_id: "{{ lookup('env', 'OS_USER_DOMAIN_ID') }}" - -# For the vsphere integration, kubelet will need credentials to access -# vsphere apis -# Documentation regarding these values can be found -# https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/providers/vsphere/vsphere.go#L105 -vsphere_vcenter_ip: "{{ lookup('env', 'VSPHERE_VCENTER') }}" -vsphere_vcenter_port: "{{ lookup('env', 'VSPHERE_VCENTER_PORT') }}" -vsphere_user: "{{ lookup('env', 'VSPHERE_USER') }}" -vsphere_password: "{{ lookup('env', 'VSPHERE_PASSWORD') }}" -vsphere_datacenter: "{{ lookup('env', 'VSPHERE_DATACENTER') }}" -vsphere_datastore: "{{ lookup('env', 'VSPHERE_DATASTORE') }}" -vsphere_working_dir: "{{ lookup('env', 'VSPHERE_WORKING_DIR') }}" -vsphere_insecure: "{{ lookup('env', 'VSPHERE_INSECURE') }}" -vsphere_resource_pool: "{{ lookup('env', 'VSPHERE_RESOURCE_POOL') }}" - -vsphere_scsi_controller_type: pvscsi -# vsphere_public_network is name of the network the VMs are joined to -vsphere_public_network: "{{ lookup('env', 'VSPHERE_PUBLIC_NETWORK') | default('') }}" - -## When azure is used, you need to also set the following variables. -## see docs/azure.md for details on how to get these values -# azure_tenant_id: -# azure_subscription_id: -# azure_aad_client_id: -# azure_aad_client_secret: -# azure_resource_group: -# azure_location: -# azure_subnet_name: -# azure_security_group_name: -# azure_vnet_name: -# azure_route_table_name: -# supported values are 'standard' or 'vmss' -# azure_vmtype: standard -# Sku of Load Balancer and Public IP. Candidate values are: basic and standard. -azure_loadbalancer_sku: basic -# excludes master nodes from standard load balancer. -azure_exclude_master_from_standard_lb: true -# disables the outbound SNAT for public load balancer rules -azure_disable_outbound_snat: false -# use instance metadata service where possible -azure_use_instance_metadata: true -# use specific Azure API endpoints -azure_cloud: AzurePublicCloud - ## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. # tls_min_version: "" @@ -265,9 +188,10 @@ conntrack_modules: - nf_conntrack - nf_conntrack_ipv4 + ## Enable distributed tracing for kubelet kubelet_tracing: false -kubelet_tracing_endpoint: 0.0.0.0:4317 +kubelet_tracing_endpoint: "[::]:4317" kubelet_tracing_sampling_rate_per_million: 100 # The maximum number of image pulls in parallel. Set it to a integer great than 1 to enable image pulling in parallel. diff --git a/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/azure-credential-check.yml b/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/azure-credential-check.yml deleted file mode 100644 index c5d6030..0000000 --- a/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/azure-credential-check.yml +++ /dev/null @@ -1,82 +0,0 @@ ---- -- name: Check azure_tenant_id value - fail: - msg: "azure_tenant_id is missing" - when: azure_tenant_id is not defined or not azure_tenant_id - -- name: Check azure_subscription_id value - fail: - msg: "azure_subscription_id is missing" - when: azure_subscription_id is not defined or not azure_subscription_id - -- name: Check azure_aad_client_id value - fail: - msg: "azure_aad_client_id is missing" - when: azure_aad_client_id is not defined or not azure_aad_client_id - -- name: Check azure_aad_client_secret value - fail: - msg: "azure_aad_client_secret is missing" - when: azure_aad_client_secret is not defined or not azure_aad_client_secret - -- name: Check azure_resource_group value - fail: - msg: "azure_resource_group is missing" - when: azure_resource_group is not defined or not azure_resource_group - -- name: Check azure_location value - fail: - msg: "azure_location is missing" - when: azure_location is not defined or not azure_location - -- name: Check azure_subnet_name value - fail: - msg: "azure_subnet_name is missing" - when: azure_subnet_name is not defined or not azure_subnet_name - -- name: Check azure_security_group_name value - fail: - msg: "azure_security_group_name is missing" - when: azure_security_group_name is not defined or not azure_security_group_name - -- name: Check azure_vnet_name value - fail: - msg: "azure_vnet_name is missing" - when: azure_vnet_name is not defined or not azure_vnet_name - -- name: Check azure_vnet_resource_group value - fail: - msg: "azure_vnet_resource_group is missing" - when: azure_vnet_resource_group is not defined or not azure_vnet_resource_group - -- name: Check azure_route_table_name value - fail: - msg: "azure_route_table_name is missing" - when: azure_route_table_name is not defined or not azure_route_table_name - -- name: Check azure_loadbalancer_sku value - fail: - msg: "azure_loadbalancer_sku has an invalid value '{{ azure_loadbalancer_sku }}'. Supported values are 'basic', 'standard'" - when: azure_loadbalancer_sku not in ["basic", "standard"] - -- name: "Check azure_exclude_master_from_standard_lb is a bool" - assert: - that: azure_exclude_master_from_standard_lb | type_debug == 'bool' - -- name: "Check azure_disable_outbound_snat is a bool" - assert: - that: azure_disable_outbound_snat | type_debug == 'bool' - -- name: "Check azure_use_instance_metadata is a bool" - assert: - that: azure_use_instance_metadata | type_debug == 'bool' - -- name: Check azure_vmtype value - fail: - msg: "azure_vmtype is missing. Supported values are 'standard' or 'vmss'" - when: azure_vmtype is not defined or not azure_vmtype - -- name: Check azure_cloud value - fail: - msg: "azure_cloud has an invalid value '{{ azure_cloud }}'. Supported values are 'AzureChinaCloud', 'AzureGermanCloud', 'AzurePublicCloud', 'AzureUSGovernmentCloud'." - when: azure_cloud not in ["AzureChinaCloud", "AzureGermanCloud", "AzurePublicCloud", "AzureUSGovernmentCloud"] diff --git a/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/openstack-credential-check.yml b/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/openstack-credential-check.yml deleted file mode 100644 index 7354d43..0000000 --- a/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/openstack-credential-check.yml +++ /dev/null @@ -1,34 +0,0 @@ ---- -- name: Check openstack_auth_url value - fail: - msg: "openstack_auth_url is missing" - when: openstack_auth_url is not defined or not openstack_auth_url - -- name: Check openstack_username value - fail: - msg: "openstack_username is missing" - when: openstack_username is not defined or not openstack_username - -- name: Check openstack_password value - fail: - msg: "openstack_password is missing" - when: openstack_password is not defined or not openstack_password - -- name: Check openstack_region value - fail: - msg: "openstack_region is missing" - when: openstack_region is not defined or not openstack_region - -- name: Check openstack_tenant_id value - fail: - msg: "one of openstack_tenant_id or openstack_trust_id must be specified" - when: - - openstack_tenant_id is not defined or not openstack_tenant_id - - openstack_trust_id is not defined - -- name: Check openstack_trust_id value - fail: - msg: "one of openstack_tenant_id or openstack_trust_id must be specified" - when: - - openstack_trust_id is not defined or not openstack_trust_id - - openstack_tenant_id is not defined diff --git a/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/vsphere-credential-check.yml b/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/vsphere-credential-check.yml deleted file mode 100644 index b18583a..0000000 --- a/kubespray/project/roles/kubernetes/node/tasks/cloud-credentials/vsphere-credential-check.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -- name: Check vsphere environment variables - fail: - msg: "{{ item.name }} is missing" - when: item.value is not defined or not item.value - with_items: - - name: vsphere_vcenter_ip - value: "{{ vsphere_vcenter_ip }}" - - name: vsphere_vcenter_port - value: "{{ vsphere_vcenter_port }}" - - name: vsphere_user - value: "{{ vsphere_user }}" - - name: vsphere_password - value: "{{ vsphere_password }}" - - name: vsphere_datacenter - value: "{{ vsphere_datacenter }}" - - name: vsphere_datastore - value: "{{ vsphere_datastore }}" - - name: vsphere_working_dir - value: "{{ vsphere_working_dir }}" - - name: vsphere_insecure - value: "{{ vsphere_insecure }}" diff --git a/kubespray/project/roles/kubernetes/node/tasks/install.yml b/kubespray/project/roles/kubernetes/node/tasks/install.yml index a89ba94..cfa90ed 100644 --- a/kubespray/project/roles/kubernetes/node/tasks/install.yml +++ b/kubespray/project/roles/kubernetes/node/tasks/install.yml @@ -8,7 +8,7 @@ tags: - kubeadm when: - - not inventory_hostname in groups['kube_control_plane'] + - not ('kube_control_plane' in group_names) - name: Install | Copy kubelet binary from download dir copy: diff --git a/kubespray/project/roles/kubernetes/node/tasks/main.yml b/kubespray/project/roles/kubernetes/node/tasks/main.yml index 56117bc..c8b8305 100644 --- a/kubespray/project/roles/kubernetes/node/tasks/main.yml +++ b/kubespray/project/roles/kubernetes/node/tasks/main.yml @@ -5,11 +5,6 @@ - facts - kubelet -- name: Pre-upgrade kubelet - import_tasks: pre_upgrade.yml - tags: - - kubelet - - name: Ensure /var/lib/cni exists file: path: /var/lib/cni @@ -24,7 +19,7 @@ - name: Install kube-vip import_tasks: loadbalancer/kube-vip.yml when: - - is_kube_master + - ('kube_control_plane' in group_names) - kube_vip_enabled tags: - kube-vip @@ -32,7 +27,7 @@ - name: Install nginx-proxy import_tasks: loadbalancer/nginx-proxy.yml when: - - not is_kube_master or kube_apiserver_bind_address != '0.0.0.0' + - ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::') - loadbalancer_apiserver_localhost - loadbalancer_apiserver_type == 'nginx' tags: @@ -41,7 +36,7 @@ - name: Install haproxy import_tasks: loadbalancer/haproxy.yml when: - - not is_kube_master or kube_apiserver_bind_address != '0.0.0.0' + - ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::') - loadbalancer_apiserver_localhost - loadbalancer_apiserver_type == 'haproxy' tags: @@ -137,52 +132,14 @@ tags: - kube-proxy -- name: Check cloud provider credentials - include_tasks: "cloud-credentials/{{ cloud_provider }}-credential-check.yml" - when: - - cloud_provider is defined - - cloud_provider in [ 'openstack', 'azure', 'vsphere' ] +- name: Modprobe Kernel Module for nftables + community.general.modprobe: + name: "nf_tables" + state: present + persistent: present + when: kube_proxy_mode == 'nftables' tags: - - cloud-provider - - facts - -- name: Test if openstack_cacert is a base64 string - set_fact: - openstack_cacert_is_base64: "{% if openstack_cacert is search('^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}= | [A-Za-z0-9+/]{2}==)?$') %}true{% else %}false{% endif %}" - when: - - cloud_provider is defined - - cloud_provider == 'openstack' - - openstack_cacert is defined - - openstack_cacert | length > 0 - - -- name: Write cacert file - copy: - src: "{{ openstack_cacert if not openstack_cacert_is_base64 else omit }}" - content: "{{ openstack_cacert | b64decode if openstack_cacert_is_base64 else omit }}" - dest: "{{ kube_config_dir }}/openstack-cacert.pem" - group: "{{ kube_cert_group }}" - mode: "0640" - when: - - cloud_provider is defined - - cloud_provider == 'openstack' - - openstack_cacert is defined - - openstack_cacert | length > 0 - tags: - - cloud-provider - -- name: Write cloud-config - template: - src: "cloud-configs/{{ cloud_provider }}-cloud-config.j2" - dest: "{{ kube_config_dir }}/cloud_config" - group: "{{ kube_cert_group }}" - mode: "0640" - when: - - cloud_provider is defined - - cloud_provider in [ 'openstack', 'azure', 'vsphere', 'aws', 'gce' ] - notify: Node | restart kubelet - tags: - - cloud-provider + - kube-proxy - name: Install kubelet import_tasks: kubelet.yml diff --git a/kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml b/kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml deleted file mode 100644 index e4bbf6b..0000000 --- a/kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml +++ /dev/null @@ -1,48 +0,0 @@ ---- -- name: "Pre-upgrade | check if kubelet container exists" - shell: >- - set -o pipefail && - {% if container_manager in ['crio', 'docker'] %} - {{ docker_bin_dir }}/docker ps -af name=kubelet | grep kubelet - {% elif container_manager == 'containerd' %} - {{ bin_dir }}/crictl ps --all --name kubelet | grep kubelet - {% endif %} - args: - executable: /bin/bash - failed_when: false - changed_when: false - check_mode: false - register: kubelet_container_check - -- name: "Pre-upgrade | copy /var/lib/cni from kubelet" - command: >- - {% if container_manager in ['crio', 'docker'] %} - docker cp kubelet:/var/lib/cni /var/lib/cni - {% elif container_manager == 'containerd' %} - ctr run --rm --mount type=bind,src=/var/lib/cni,dst=/cnilibdir,options=rbind:rw kubelet kubelet-tmp sh -c 'cp /var/lib/cni/* /cnilibdir/' - {% endif %} - args: - creates: "/var/lib/cni" - failed_when: false - when: kubelet_container_check.rc == 0 - -- name: "Pre-upgrade | ensure kubelet container service is stopped if using host deployment" - service: - name: kubelet - state: stopped - when: kubelet_container_check.rc == 0 - -- name: "Pre-upgrade | ensure kubelet container is removed if using host deployment" - shell: >- - {% if container_manager in ['crio', 'docker'] %} - {{ docker_bin_dir }}/docker rm -fv kubelet - {% elif container_manager == 'containerd' %} - {{ bin_dir }}/crictl stop kubelet && {{ bin_dir }}/crictl rm kubelet - {% endif %} - failed_when: false - changed_when: false - register: remove_kubelet_container - retries: 4 - until: remove_kubelet_container.rc == 0 - delay: 5 - when: kubelet_container_check.rc == 0 diff --git a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/aws-cloud-config.j2 b/kubespray/project/roles/kubernetes/node/templates/cloud-configs/aws-cloud-config.j2 deleted file mode 100644 index f6d0c3d..0000000 --- a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/aws-cloud-config.j2 +++ /dev/null @@ -1,11 +0,0 @@ -[Global] -zone={{ aws_zone|default("") }} -vpc={{ aws_vpc|default("") }} -subnetId={{ aws_subnet_id|default("") }} -routeTableId={{ aws_route_table_id|default("") }} -roleArn={{ aws_role_arn|default("") }} -kubernetesClusterTag={{ aws_kubernetes_cluster_tag|default("") }} -kubernetesClusterId={{ aws_kubernetes_cluster_id|default("") }} -disableSecurityGroupIngress={{ "true" if aws_disable_security_group_ingress|default(False) else "false" }} -disableStrictZoneCheck={{ "true" if aws_disable_strict_zone_check|default(False) else "false" }} -elbSecurityGroup={{ aws_elb_security_group|default("") }} diff --git a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/azure-cloud-config.j2 b/kubespray/project/roles/kubernetes/node/templates/cloud-configs/azure-cloud-config.j2 deleted file mode 100644 index 2b1c101..0000000 --- a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/azure-cloud-config.j2 +++ /dev/null @@ -1,26 +0,0 @@ -{ - "cloud": "{{ azure_cloud }}", - "tenantId": "{{ azure_tenant_id }}", - "subscriptionId": "{{ azure_subscription_id }}", - "aadClientId": "{{ azure_aad_client_id }}", - "aadClientSecret": "{{ azure_aad_client_secret }}", - "resourceGroup": "{{ azure_resource_group }}", - "location": "{{ azure_location }}", - "subnetName": "{{ azure_subnet_name }}", - "securityGroupName": "{{ azure_security_group_name }}", - "securityGroupResourceGroup": "{{ azure_security_group_resource_group | default(azure_vnet_resource_group) }}", - "vnetName": "{{ azure_vnet_name }}", - "vnetResourceGroup": "{{ azure_vnet_resource_group }}", - "routeTableName": "{{ azure_route_table_name }}", - "routeTableResourceGroup": "{{ azure_route_table_resource_group | default(azure_vnet_resource_group) }}", - "vmType": "{{ azure_vmtype }}", -{% if azure_primary_availability_set_name is defined %} - "primaryAvailabilitySetName": "{{ azure_primary_availability_set_name }}", -{%endif%} - "useInstanceMetadata": {{azure_use_instance_metadata | lower }}, -{% if azure_loadbalancer_sku == "standard" %} - "excludeMasterFromStandardLB": {{ azure_exclude_master_from_standard_lb | lower }}, - "disableOutboundSNAT": {{ azure_disable_outbound_snat | lower }}, -{% endif%} - "loadBalancerSku": "{{ azure_loadbalancer_sku }}" -} diff --git a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/gce-cloud-config.j2 b/kubespray/project/roles/kubernetes/node/templates/cloud-configs/gce-cloud-config.j2 deleted file mode 100644 index 3995126..0000000 --- a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/gce-cloud-config.j2 +++ /dev/null @@ -1,2 +0,0 @@ -[global] -node-tags = {{ gce_node_tags }} diff --git a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/openstack-cloud-config.j2 b/kubespray/project/roles/kubernetes/node/templates/cloud-configs/openstack-cloud-config.j2 deleted file mode 100644 index b1f8e0a..0000000 --- a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/openstack-cloud-config.j2 +++ /dev/null @@ -1,54 +0,0 @@ -[Global] -auth-url="{{ openstack_auth_url }}" -username="{{ openstack_username }}" -password="{{ openstack_password }}" -region="{{ openstack_region }}" -{% if openstack_trust_id is defined and openstack_trust_id != "" %} -trust-id="{{ openstack_trust_id }}" -{% else %} -tenant-id="{{ openstack_tenant_id }}" -{% endif %} -{% if openstack_tenant_name is defined and openstack_tenant_name != "" %} -tenant-name="{{ openstack_tenant_name }}" -{% endif %} -{% if openstack_domain_name is defined and openstack_domain_name != "" %} -domain-name="{{ openstack_domain_name }}" -{% elif openstack_domain_id is defined and openstack_domain_id != "" %} -domain-id ="{{ openstack_domain_id }}" -{% endif %} -{% if openstack_cacert is defined and openstack_cacert != "" %} -ca-file="{{ kube_config_dir }}/openstack-cacert.pem" -{% endif %} - -[BlockStorage] -{% if openstack_blockstorage_version is defined %} -bs-version={{ openstack_blockstorage_version }} -{% endif %} -{% if openstack_blockstorage_ignore_volume_az is defined and openstack_blockstorage_ignore_volume_az|bool %} -ignore-volume-az={{ openstack_blockstorage_ignore_volume_az }} -{% endif %} -{% if node_volume_attach_limit is defined and node_volume_attach_limit != "" %} -node-volume-attach-limit="{{ node_volume_attach_limit }}" -{% endif %} - -{% if openstack_lbaas_enabled and openstack_lbaas_subnet_id is defined %} -[LoadBalancer] -subnet-id={{ openstack_lbaas_subnet_id }} -{% if openstack_lbaas_floating_network_id is defined %} -floating-network-id={{ openstack_lbaas_floating_network_id }} -{% endif %} -{% if openstack_lbaas_use_octavia is defined %} -use-octavia={{ openstack_lbaas_use_octavia }} -{% endif %} -{% if openstack_lbaas_method is defined %} -lb-method={{ openstack_lbaas_method }} -{% endif %} -{% if openstack_lbaas_provider is defined %} -lb-provider={{ openstack_lbaas_provider }} -{% endif %} - -create-monitor={{ openstack_lbaas_create_monitor }} -monitor-delay={{ openstack_lbaas_monitor_delay }} -monitor-timeout={{ openstack_lbaas_monitor_timeout }} -monitor-max-retries={{ openstack_lbaas_monitor_max_retries }} -{% endif %} diff --git a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/vsphere-cloud-config.j2 b/kubespray/project/roles/kubernetes/node/templates/cloud-configs/vsphere-cloud-config.j2 deleted file mode 100644 index 2cda7f6..0000000 --- a/kubespray/project/roles/kubernetes/node/templates/cloud-configs/vsphere-cloud-config.j2 +++ /dev/null @@ -1,36 +0,0 @@ -[Global] -user = "{{ vsphere_user }}" -password = "{{ vsphere_password }}" -port = {{ vsphere_vcenter_port }} -insecure-flag = {{ vsphere_insecure }} - -datacenters = "{{ vsphere_datacenter }}" - -[VirtualCenter "{{ vsphere_vcenter_ip }}"] - - -[Workspace] -server = "{{ vsphere_vcenter_ip }}" -datacenter = "{{ vsphere_datacenter }}" -folder = "{{ vsphere_working_dir }}" -default-datastore = "{{ vsphere_datastore }}" -{% if vsphere_resource_pool is defined and vsphere_resource_pool != "" %} -resourcepool-path = "{{ vsphere_resource_pool }}" -{% endif %} - - -[Disk] -scsicontrollertype = {{ vsphere_scsi_controller_type }} - -{% if vsphere_public_network is defined and vsphere_public_network != "" %} -[Network] -public-network = {{ vsphere_public_network }} -{% endif %} - -[Labels] -{% if vsphere_zone_category is defined and vsphere_zone_category != "" %} -zone = {{ vsphere_zone_category }} -{% endif %} -{% if vsphere_region_category is defined and vsphere_region_category != "" %} -region = {{ vsphere_region_category }} -{% endif %} diff --git a/kubespray/project/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2 b/kubespray/project/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2 index bc59f03..6035611 100644 --- a/kubespray/project/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2 +++ b/kubespray/project/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2 @@ -26,12 +26,13 @@ staticPodPath: {{ kube_manifest_dir }} cgroupDriver: {{ kubelet_cgroup_driver | default('systemd') }} containerLogMaxFiles: {{ kubelet_logfiles_max_nr }} containerLogMaxSize: {{ kubelet_logfiles_max_size }} +containerRuntimeEndpoint : {{ cri_socket }} maxPods: {{ kubelet_max_pods }} podPidsLimit: {{ kubelet_pod_pids_limit }} -address: {{ kubelet_bind_address }} +address: "{{ kubelet_bind_address }}" readOnlyPort: {{ kube_read_only_port }} healthzPort: {{ kubelet_healthz_port }} -healthzBindAddress: {{ kubelet_healthz_bind_address }} +healthzBindAddress: "{{ kubelet_healthz_bind_address }}" kubeletCgroups: {{ kubelet_kubelet_cgroups }} clusterDomain: {{ dns_domain }} {% if kubelet_protect_kernel_defaults | bool %} @@ -60,56 +61,16 @@ clusterDNS: - {{ dns_address }} {% endfor %} {# Node reserved CPU/memory #} -{% if kube_reserved | bool %} -kubeReservedCgroup: {{ kube_reserved_cgroups }} +{% for scope in "kube", "system" %} +{% if lookup('ansible.builtin.vars', scope + "_reserved") | bool %} +{{ scope }}ReservedCgroup: {{ lookup('ansible.builtin.vars', scope + '_reserved_cgroups') }} {% endif %} -kubeReserved: -{% if is_kube_master | bool %} - cpu: "{{ kube_master_cpu_reserved }}" - memory: {{ kube_master_memory_reserved }} -{% if kube_master_ephemeral_storage_reserved is defined %} - ephemeral-storage: {{ kube_master_ephemeral_storage_reserved }} -{% endif %} -{% if kube_master_pid_reserved is defined %} - pid: "{{ kube_master_pid_reserved }}" -{% endif %} -{% else %} - cpu: "{{ kube_cpu_reserved }}" - memory: {{ kube_memory_reserved }} -{% if kube_ephemeral_storage_reserved is defined %} - ephemeral-storage: {{ kube_ephemeral_storage_reserved }} -{% endif %} -{% if kube_pid_reserved is defined %} - pid: "{{ kube_pid_reserved }}" -{% endif %} -{% endif %} -{% if system_reserved | bool %} -systemReservedCgroup: {{ system_reserved_cgroups }} -systemReserved: -{% if is_kube_master | bool %} - cpu: "{{ system_master_cpu_reserved }}" - memory: {{ system_master_memory_reserved }} -{% if system_master_ephemeral_storage_reserved is defined %} - ephemeral-storage: {{ system_master_ephemeral_storage_reserved }} -{% endif %} -{% if system_master_pid_reserved is defined %} - pid: "{{ system_master_pid_reserved }}" -{% endif %} -{% else %} - cpu: "{{ system_cpu_reserved }}" - memory: {{ system_memory_reserved }} -{% if system_ephemeral_storage_reserved is defined %} - ephemeral-storage: {{ system_ephemeral_storage_reserved }} -{% endif %} -{% if system_pid_reserved is defined %} - pid: "{{ system_pid_reserved }}" -{% endif %} -{% endif %} -{% endif %} -{% if is_kube_master | bool and eviction_hard_control_plane is defined and eviction_hard_control_plane %} -evictionHard: - {{ eviction_hard_control_plane | to_nice_yaml(indent=2) | indent(2) }} -{% elif not is_kube_master | bool and eviction_hard is defined and eviction_hard %} +{{ scope }}Reserved: +{% for resource in "cpu", "memory", "ephemeral-storage", "pid" %} + {{ resource }}: "{{ lookup('ansible.builtin.vars', scope + '_' ~ (resource | replace('-', '_')) + '_reserved') }}" +{% endfor %} +{% endfor %} +{% if eviction_hard is defined and eviction_hard %} evictionHard: {{ eviction_hard | to_nice_yaml(indent=2) | indent(2) }} {% endif %} @@ -117,9 +78,6 @@ resolvConf: "{{ kube_resolv_conf }}" {% if kubelet_config_extra_args %} {{ kubelet_config_extra_args | to_nice_yaml(indent=2) }} {% endif %} -{% if inventory_hostname in groups['kube_node'] and kubelet_node_config_extra_args %} -{{ kubelet_node_config_extra_args | to_nice_yaml(indent=2) }} -{% endif %} {% if kubelet_feature_gates or kube_feature_gates %} featureGates: {% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %} @@ -162,7 +120,7 @@ cpuManagerPolicy: {{ kubelet_cpu_manager_policy }} {% endif %} {% if kubelet_cpu_manager_policy_options is defined %} cpuManagerPolicyOptions: - {{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) }} + {{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) | indent(width=2) }} {% endif %} {% if kubelet_topology_manager_policy is defined %} topologyManagerPolicy: {{ kubelet_topology_manager_policy }} @@ -172,7 +130,7 @@ topologyManagerScope: {{ kubelet_topology_manager_scope }} {% endif %} {% if kubelet_tracing %} tracing: - endpoint: {{ kubelet_tracing_endpoint }} + endpoint: "{{ kubelet_tracing_endpoint }}" samplingRatePerMillion: {{ kubelet_tracing_sampling_rate_per_million }} {% endif %} maxParallelImagePulls: {{ kubelet_max_parallel_image_pulls }} diff --git a/kubespray/project/roles/kubernetes/node/templates/kubelet.env.v1beta1.j2 b/kubespray/project/roles/kubernetes/node/templates/kubelet.env.v1beta1.j2 index a5aa369..a528041 100644 --- a/kubespray/project/roles/kubernetes/node/templates/kubelet.env.v1beta1.j2 +++ b/kubespray/project/roles/kubernetes/node/templates/kubelet.env.v1beta1.j2 @@ -11,20 +11,17 @@ KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}" --config={{ kube_config_dir }}/kubelet-config.yaml \ --kubeconfig={{ kube_config_dir }}/kubelet.conf \ {# end kubeadm specific settings #} ---container-runtime-endpoint={{ cri_socket }} \ --runtime-cgroups={{ kubelet_runtime_cgroups }} \ {% endset %} -KUBELET_ARGS="{{ kubelet_args_base }} {% if kubelet_custom_flags is string %} {{kubelet_custom_flags}} {% else %}{% for flag in kubelet_custom_flags %} {{flag}} {% endfor %}{% endif %}{% if inventory_hostname in groups['kube_node'] %}{% if kubelet_node_custom_flags is string %} {{kubelet_node_custom_flags}} {% else %}{% for flag in kubelet_node_custom_flags %} {{flag}} {% endfor %}{% endif %}{% endif %}" +KUBELET_ARGS="{{ kubelet_args_base }} {{ kubelet_custom_flags | join(' ') }}" {% if kubelet_flexvolumes_plugins_dir is defined %} KUBELET_VOLUME_PLUGIN="--volume-plugin-dir={{ kubelet_flexvolumes_plugins_dir }}" {% endif %} {% if kube_network_plugin is defined and kube_network_plugin == "cloud" %} KUBELET_NETWORK_PLUGIN="--hairpin-mode=promiscuous-bridge --network-plugin=kubenet" {% endif %} -{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %} -KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }} --cloud-config={{ kube_config_dir }}/cloud_config" -{% elif cloud_provider is defined and cloud_provider in ["external"] %} +{% if cloud_provider == "external" %} KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }}" {% else %} KUBELET_CLOUDPROVIDER="" diff --git a/kubespray/project/roles/kubernetes/node/templates/loadbalancer/haproxy.cfg.j2 b/kubespray/project/roles/kubernetes/node/templates/loadbalancer/haproxy.cfg.j2 index c629325..bd6514a 100644 --- a/kubespray/project/roles/kubernetes/node/templates/loadbalancer/haproxy.cfg.j2 +++ b/kubespray/project/roles/kubernetes/node/templates/loadbalancer/haproxy.cfg.j2 @@ -22,7 +22,7 @@ defaults {% if loadbalancer_apiserver_healthcheck_port is defined -%} frontend healthz bind 0.0.0.0:{{ loadbalancer_apiserver_healthcheck_port }} - {% if enable_dual_stack_networks -%} + {% if ipv6_stack -%} bind :::{{ loadbalancer_apiserver_healthcheck_port }} {% endif -%} mode http @@ -31,7 +31,7 @@ frontend healthz frontend kube_api_frontend bind 127.0.0.1:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }} - {% if enable_dual_stack_networks -%} + {% if ipv6_stack -%} bind [::1]:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }}; {% endif -%} mode tcp @@ -45,5 +45,5 @@ backend kube_api_backend option httpchk GET /healthz http-check expect status 200 {% for host in groups['kube_control_plane'] -%} - server {{ host }} {{ hostvars[host]['access_ip'] | default(hostvars[host]['ip'] | default(fallback_ips[host])) }}:{{ kube_apiserver_port }} check check-ssl verify none + server {{ host }} {{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} check check-ssl verify none {% endfor -%} diff --git a/kubespray/project/roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2 b/kubespray/project/roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2 index 07b9370..c57f47b 100644 --- a/kubespray/project/roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2 +++ b/kubespray/project/roles/kubernetes/node/templates/loadbalancer/nginx.conf.j2 @@ -14,13 +14,13 @@ stream { upstream kube_apiserver { least_conn; {% for host in groups['kube_control_plane'] -%} - server {{ hostvars[host]['access_ip'] | default(hostvars[host]['ip'] | default(fallback_ips[host])) }}:{{ kube_apiserver_port }}; + server {{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}; {% endfor -%} } server { listen 127.0.0.1:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }}; - {% if enable_dual_stack_networks -%} + {% if ipv6_stack -%} listen [::1]:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }}; {% endif -%} proxy_pass kube_apiserver; @@ -44,7 +44,7 @@ http { {% if loadbalancer_apiserver_healthcheck_port is defined -%} server { listen {{ loadbalancer_apiserver_healthcheck_port }}; - {% if enable_dual_stack_networks -%} + {% if ipv6_stack -%} listen [::]:{{ loadbalancer_apiserver_healthcheck_port }}; {% endif -%} location /healthz { diff --git a/kubespray/project/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 b/kubespray/project/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 index 35b6f0e..8033a26 100644 --- a/kubespray/project/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 +++ b/kubespray/project/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 @@ -104,11 +104,16 @@ spec: imagePullPolicy: {{ k8s_image_pull_policy }} name: kube-vip resources: {} +{% if kube_vip_lb_fwdmethod == "masquerade" %} + securityContext: + privileged: true +{% else %} securityContext: capabilities: add: - NET_ADMIN - NET_RAW +{% endif %} volumeMounts: - mountPath: /etc/kubernetes/admin.conf name: kubeconfig diff --git a/kubespray/project/roles/kubernetes/node/templates/node-kubeconfig.yaml.j2 b/kubespray/project/roles/kubernetes/node/templates/node-kubeconfig.yaml.j2 index 4b8af60..7451022 100644 --- a/kubespray/project/roles/kubernetes/node/templates/node-kubeconfig.yaml.j2 +++ b/kubespray/project/roles/kubernetes/node/templates/node-kubeconfig.yaml.j2 @@ -5,7 +5,7 @@ clusters: - name: local cluster: certificate-authority: {{ kube_cert_dir }}/ca.pem - server: {{ kube_apiserver_endpoint }} + server: "{{ kube_apiserver_endpoint }}" users: - name: kubelet user: diff --git a/kubespray/project/roles/kubernetes/preinstall/defaults/main.yml b/kubespray/project/roles/kubernetes/preinstall/defaults/main.yml index bf537f1..c4c7654 100644 --- a/kubespray/project/roles/kubernetes/preinstall/defaults/main.yml +++ b/kubespray/project/roles/kubernetes/preinstall/defaults/main.yml @@ -1,8 +1,11 @@ --- # Set to true to allow pre-checks to fail and continue deployment ignore_assert_errors: false - -epel_enabled: false +# Set to false to disable the backup parameter, set to true to accumulate backups of config files. +leave_etc_backup_files: true +nameservers: [] +cloud_resolver: [] +disable_host_nameservers: false # Kubespray sets this to true after clusterDNS is running to apply changes to the host resolv.conf dns_late: false @@ -51,26 +54,7 @@ etc_hosts_localhost_entries: minimal_node_memory_mb: 1024 minimal_master_memory_mb: 1500 -yum_repo_dir: /etc/yum.repos.d - -# number of times package install task should be retried -pkg_install_retries: 4 - -# Check if access_ip responds to ping. Set false if your firewall blocks ICMP. -ping_access_ip: true - ## NTP Settings -# Start the ntpd or chrony service and enable it at system boot. -ntp_enabled: false -# The package to install which provides NTP functionality. -# The default is ntp for most platforms, or chrony on RHEL/CentOS 7 and later. -# The ntp_package can be one of ['ntp', 'chrony'] -ntp_package: >- - {% if ansible_os_family == "RedHat" -%} - chrony - {%- else -%} - ntp - {%- endif -%} # Manage the NTP configuration file. ntp_manage_config: false @@ -95,8 +79,13 @@ ntp_filter_interface: false # - listen xxx # The NTP driftfile path # Only takes effect when ntp_manage_config is true. -ntp_driftfile: /var/lib/ntp/ntp.drift -# Enable tinker panic is useful when running NTP in a VM environment. +# Default value is `/var/lib/ntp/ntp.drift`, for ntpsec use '/var/lib/ntpsec/ntp.drift' +ntp_driftfile: >- + {% if ntp_package == "ntpsec" -%} + /var/lib/ntpsec/ntp.drift + {%- else -%} + /var/lib/ntp/ntp.drift + {%- endif -%} # Only takes effect when ntp_manage_config is true. ntp_tinker_panic: false diff --git a/kubespray/project/roles/kubernetes/preinstall/files/pkgs-schema.json b/kubespray/project/roles/kubernetes/preinstall/files/pkgs-schema.json deleted file mode 100644 index 1fb9e28..0000000 --- a/kubespray/project/roles/kubernetes/preinstall/files/pkgs-schema.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://kubespray.io/internal/os_packages.schema.json", - "title": "Os packages", - "description": "Criteria for selecting packages to install on Kubernetes nodes during installation by Kubespray", - "type": "object", - "patternProperties": { - ".*": { - "type": "object", - "additionalProperties": false, - "properties": { - "enabled": { - "description": "Escape hatch to filter packages. The value is expected to be pre-resolved to a boolean by Jinja", - "type": "boolean", - "default": true - }, - "groups": { - "description": "Match if the host is in one of these groups. If not specified match any host.", - "type": "array", - "minItems": 1, - "items":{ - "type": "string", - "pattern": "^[0-9A-Za-z_]*$" - } - }, - "os": { - "type": "object", - "description": "If not specified match any OS. Otherwise, must match by 'families' or 'distributions' to be included.", - "additionalProperties": false, - "minProperties": 1, - "properties": { - "families": { - "description": "Match if ansible_os_family is part of the list.", - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, - "distributions": { - "type": "object", - "description": "Match if ansible_distribution match one of defined keys.", - "minProperties": 1, - "patternProperties": { - ".*": { - "description": "Match if either the value is the empty hash, or one major_versions/versions/releases contains the corresponding variable ('ansible_distrbution_*')", - "type": "object", - "additionalProperties": false, - "properties": { - "major_versions": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, - "versions": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, - "releases": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - } - } - } - } - } - } - } - } - } - } -} diff --git a/kubespray/project/roles/kubernetes/preinstall/handlers/main.yml b/kubespray/project/roles/kubernetes/preinstall/handlers/main.yml index cc69fe4..34502d5 100644 --- a/kubespray/project/roles/kubernetes/preinstall/handlers/main.yml +++ b/kubespray/project/roles/kubernetes/preinstall/handlers/main.yml @@ -35,7 +35,7 @@ get_checksum: false get_mime: false register: kube_apiserver_set - when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf' + when: ('kube_control_plane' in group_names) and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf' listen: Preinstall | propagate resolvconf to k8s components # FIXME(mattymo): Also restart for kubeadm mode @@ -46,7 +46,7 @@ get_checksum: false get_mime: false register: kube_controller_set - when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf' + when: ('kube_control_plane' in group_names) and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf' listen: Preinstall | propagate resolvconf to k8s components - name: Preinstall | restart kube-controller-manager docker @@ -55,7 +55,7 @@ executable: /bin/bash when: - container_manager == "docker" - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - dns_mode != 'none' - resolvconf_mode == 'host_resolvconf' - kube_controller_set.stat.exists @@ -71,7 +71,7 @@ until: preinstall_restart_controller_manager.rc == 0 when: - container_manager in ['crio', 'containerd'] - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - dns_mode != 'none' - resolvconf_mode == 'host_resolvconf' - kube_controller_set.stat.exists @@ -83,7 +83,7 @@ executable: /bin/bash when: - container_manager == "docker" - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - dns_mode != 'none' - resolvconf_mode == 'host_resolvconf' - kube_apiserver_set.stat.exists @@ -99,7 +99,7 @@ delay: 1 when: - container_manager in ['crio', 'containerd'] - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - dns_mode != 'none' - resolvconf_mode == 'host_resolvconf' - kube_apiserver_set.stat.exists @@ -116,7 +116,7 @@ delay: 1 when: - dns_late - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - dns_mode != 'none' - resolvconf_mode == 'host_resolvconf' - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] and not is_fedora_coreos diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0020-set_facts.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0020-set_facts.yml index 263bca4..9213f6b 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0020-set_facts.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0020-set_facts.yml @@ -33,30 +33,12 @@ failed_when: false register: resolvconf_stat -- name: Fetch resolvconf - when: resolvconf_stat.stat.exists is defined and resolvconf_stat.stat.exists - block: - - - name: Get content of /etc/resolv.conf - slurp: - src: /etc/resolv.conf - register: resolvconf_slurp - - - name: Get currently configured nameservers - set_fact: - configured_nameservers: "{{ resolvconf_slurp.content | b64decode | regex_findall('^nameserver\\s*(\\S*)', multiline=True) | ansible.utils.ipaddr }}" - when: resolvconf_slurp.content is defined - -- name: Stop if /etc/resolv.conf not configured nameservers - assert: - that: configured_nameservers | length>0 - fail_msg: "nameserver should not empty in /etc/resolv.conf" - when: - - not ignore_assert_errors - - configured_nameservers is defined - - not (upstream_dns_servers is defined and upstream_dns_servers | length > 0) - - not (disable_host_nameservers | default(false)) - - dns_mode in ['coredns', 'coredns_dual'] + # Used in vars/ +- name: Fetch resolv.conf + when: resolvconf_stat.stat.exists + slurp: + src: /etc/resolv.conf + register: resolvconf_slurp - name: NetworkManager | Check if host has NetworkManager # noqa command-instead-of-module - Should we use service_facts for this? @@ -77,19 +59,12 @@ - name: Set default dns if remove_default_searchdomains is false set_fact: default_searchdomains: ["default.svc.{{ dns_domain }}", "svc.{{ dns_domain }}"] - when: not remove_default_searchdomains | default() | bool or (remove_default_searchdomains | default() | bool and searchdomains | default([]) | length==0) + when: not remove_default_searchdomains | default() | bool or (remove_default_searchdomains | default() | bool and searchdomains | length == 0) - name: Set dns facts set_fact: resolvconf: >- {%- if resolvconf.rc == 0 and resolvconfd_path.stat.isdir is defined and resolvconfd_path.stat.isdir -%}true{%- else -%}false{%- endif -%} - bogus_domains: |- - {% for d in default_searchdomains | default([]) + searchdomains | default([]) -%} - {{ dns_domain }}.{{ d }}./{{ d }}.{{ d }}./com.{{ d }}./ - {%- endfor %} - cloud_resolver: "{{ ['169.254.169.254'] if cloud_provider is defined and cloud_provider == 'gce' else - ['169.254.169.253'] if cloud_provider is defined and cloud_provider == 'aws' else - [] }}" - name: Check if kubelet is configured stat: @@ -154,58 +129,6 @@ dhclienthookfile: /etc/dhcp/dhclient-exit-hooks.d/zdnsupdate when: ansible_os_family == "Debian" -- name: Generate search domains to resolvconf - set_fact: - searchentries: - search {{ (default_searchdomains | default([]) + searchdomains | default([])) | join(' ') }} - domainentry: - domain {{ dns_domain }} - supersede_search: - supersede domain-search "{{ (default_searchdomains | default([]) + searchdomains | default([])) | join('", "') }}"; - supersede_domain: - supersede domain-name "{{ dns_domain }}"; - -- name: Pick coredns cluster IP or default resolver - set_fact: - coredns_server: |- - {%- if dns_mode == 'coredns' and not dns_early | bool -%} - {{ [skydns_server] }} - {%- elif dns_mode == 'coredns_dual' and not dns_early | bool -%} - {{ [skydns_server] + [skydns_server_secondary] }} - {%- elif dns_mode == 'manual' and not dns_early | bool -%} - {{ (manual_dns_server.split(',') | list) }} - {%- elif dns_mode == 'none' and not dns_early | bool -%} - [] - {%- elif dns_early | bool -%} - {{ upstream_dns_servers | default([]) }} - {%- endif -%} - -# This task should only run after cluster/nodelocal DNS is up, otherwise all DNS lookups will timeout -- name: Generate nameservers for resolvconf, including cluster DNS - set_fact: - nameserverentries: |- - {{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique | join(',') }} - dhclient_supersede_nameserver_entries_list: |- - {{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique }} - when: not dns_early or dns_late - -# This task should run instead of the above task when cluster/nodelocal DNS hasn't -# been deployed yet (like scale.yml/cluster.yml) or when it's down (reset.yml) -- name: Generate nameservers for resolvconf, not including cluster DNS - set_fact: - nameserverentries: |- - {{ (nameservers | d([]) + cloud_resolver | d([]) + configured_nameservers | d([])) | unique | join(',') }} - dhclient_supersede_nameserver_entries_list: |- - {{ (nameservers | d([]) + cloud_resolver | d([])) | unique }} - when: dns_early and not dns_late - -- name: Generate supersede_nameserver from dhclient_supersede_nameserver_entries_list - set_fact: - supersede_nameserver: |- - {%- if dhclient_supersede_nameserver_entries_list | length > 0 -%} - supersede domain-name-servers {{ dhclient_supersede_nameserver_entries_list | join(', ') }}; - {%- endif -%} - - name: Set etcd vars if using kubeadm mode set_fact: etcd_cert_dir: "{{ kube_cert_dir }}" diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml index af9ca06..186a46c 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml @@ -1,19 +1,18 @@ --- -- name: Stop if kube_control_plane group is empty +- name: Stop if any host not in '--limit' does not have a fact cache + vars: + uncached_hosts: "{{ hostvars | dict2items | selectattr('value.ansible_default_ipv6', 'undefined') | selectattr('value.ansible_default_ipv4', 'undefined') | map(attribute='key') }}" + excluded_hosts: "{{ groups['k8s_cluster'] | difference(query('inventory_hostnames', ansible_limit)) }}" assert: - that: groups.get( 'kube_control_plane' ) - run_once: true - when: not ignore_assert_errors - -- name: Stop if etcd group is empty in external etcd mode - assert: - that: groups.get('etcd') - fail_msg: "Group 'etcd' cannot be empty in external etcd mode" + that: uncached_hosts | intersect(excluded_hosts) == [] + fail_msg: | + Kubespray does not support '--limit' without a populated facts cache for the excluded hosts. + Please run the facts.yml playbook first without '--limit'. + The following excluded hosts are not cached: {{ uncached_hosts | intersect(excluded_hosts) }} run_once: true when: + - ansible_limit is defined - not ignore_assert_errors - - etcd_deployment_type != "kubeadm" - - name: Stop if non systemd OS type assert: that: ansible_service_mgr == "systemd" @@ -25,54 +24,19 @@ msg: "{{ ansible_distribution }} is not a known OS" when: not ignore_assert_errors -- name: Stop if unknown network plugin - assert: - that: kube_network_plugin in ['calico', 'flannel', 'weave', 'cloud', 'cilium', 'cni', 'kube-ovn', 'kube-router', 'macvlan', 'custom_cni'] - msg: "{{ kube_network_plugin }} is not supported" - when: - - kube_network_plugin is defined - - not ignore_assert_errors - -- name: Stop if unsupported version of Kubernetes - assert: - that: kube_version is version(kube_version_min_required, '>=') - msg: "The current release of Kubespray only support newer version of Kubernetes than {{ kube_version_min_required }} - You are trying to apply {{ kube_version }}" - when: not ignore_assert_errors - -# simplify this items-list when https://github.com/ansible/ansible/issues/15753 is resolved -- name: "Stop if known booleans are set as strings (Use JSON format on CLI: -e \"{'key': true }\")" - assert: - that: item.value | type_debug == 'bool' - msg: "{{ item.value }} isn't a bool" - run_once: true - with_items: - - { name: download_run_once, value: "{{ download_run_once }}" } - - { name: deploy_netchecker, value: "{{ deploy_netchecker }}" } - - { name: download_always_pull, value: "{{ download_always_pull }}" } - - { name: helm_enabled, value: "{{ helm_enabled }}" } - - { name: openstack_lbaas_enabled, value: "{{ openstack_lbaas_enabled }}" } - when: not ignore_assert_errors - -- name: Stop if even number of etcd hosts - assert: - that: groups.etcd | length is not divisibleby 2 - when: - - not ignore_assert_errors - - inventory_hostname in groups.get('etcd',[]) - -- name: Stop if memory is too small for masters +- name: Stop if memory is too small for control plane nodes assert: that: ansible_memtotal_mb >= minimal_master_memory_mb when: - not ignore_assert_errors - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - name: Stop if memory is too small for nodes assert: that: ansible_memtotal_mb >= minimal_node_memory_mb when: - not ignore_assert_errors - - inventory_hostname in groups['kube_node'] + - ('kube_node' in group_names) # This command will fail if cgroups are not enabled on the node. # For reference: https://kubernetes.io/docs/concepts/architecture/cgroups/#check-cgroup-version @@ -81,21 +45,6 @@ changed_when: false when: not ignore_assert_errors -# This assertion will fail on the safe side: One can indeed schedule more pods -# on a node than the CIDR-range has space for when additional pods use the host -# network namespace. It is impossible to ascertain the number of such pods at -# provisioning time, so to establish a guarantee, we factor these out. -# NOTICE: the check blatantly ignores the inet6-case -- name: Guarantee that enough network address space is available for all pods - assert: - that: "{{ (kubelet_max_pods | default(110)) | int <= (2 ** (32 - kube_network_node_prefix | int)) - 2 }}" - msg: "Do not schedule more pods on a node than inet addresses are available." - when: - - not ignore_assert_errors - - inventory_hostname in groups['k8s_cluster'] - - kube_network_node_prefix is defined - - kube_network_plugin != 'calico' - - name: Stop if ip var does not match local ips assert: that: (ip in ansible_all_ipv4_addresses) or (ip in ansible_all_ipv6_addresses) @@ -104,50 +53,26 @@ - not ignore_assert_errors - ip is defined -- name: Ensure ping package - package: - # noqa: jinja[spacing] - name: >- - {%- if ansible_os_family == 'Debian' -%} - iputils-ping - {%- else -%} - iputils - {%- endif -%} - state: present - when: - - access_ip is defined - - not ignore_assert_errors - - ping_access_ip - - not is_fedora_coreos - - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] - - name: Stop if access_ip is not pingable - command: ping -c1 {{ access_ip }} + command: ping -c1 {{ main_access_ip }} when: - - access_ip is defined + - main_access_ip is defined - not ignore_assert_errors - ping_access_ip changed_when: false -- name: Stop if RBAC is not enabled when dashboard is enabled - assert: - that: rbac_enabled - when: - - dashboard_enabled - - not ignore_assert_errors - -- name: Stop if RBAC is not enabled when OCI cloud controller is enabled - assert: - that: rbac_enabled - when: - - cloud_provider is defined and cloud_provider == "oci" - - not ignore_assert_errors - -- name: Stop if kernel version is too low +- name: Stop if kernel version is too low for cilium assert: that: ansible_kernel.split('-')[0] is version('4.9.17', '>=') when: - - kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin == 'cilium' or cilium_deploy_additionally + - not ignore_assert_errors + +- name: Stop if kernel version is too low for nftables + assert: + that: ansible_kernel.split('-')[0] is version('5.13', '>=') + when: + - kube_proxy_mode == 'nftables' - not ignore_assert_errors - name: Stop if bad hostname @@ -156,179 +81,17 @@ msg: "Hostname must consist of lower case alphanumeric characters, '.' or '-', and must start and end with an alphanumeric character" when: not ignore_assert_errors -- name: Check cloud_provider value +- name: Stop if /etc/resolv.conf has no configured nameservers assert: - that: cloud_provider in ['gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', 'external'] - msg: "If set the 'cloud_provider' var must be set either to 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci' or 'external'" + that: configured_nameservers | length>0 + fail_msg: "nameserver should not be empty in /etc/resolv.conf" when: - - cloud_provider is defined - - not ignore_assert_errors - tags: - - cloud-provider - - facts - -- name: "Check that kube_service_addresses is a network range" - assert: - that: - - kube_service_addresses | ansible.utils.ipaddr('net') - msg: "kube_service_addresses = '{{ kube_service_addresses }}' is not a valid network range" - run_once: true - -- name: "Check that kube_pods_subnet is a network range" - assert: - that: - - kube_pods_subnet | ansible.utils.ipaddr('net') - msg: "kube_pods_subnet = '{{ kube_pods_subnet }}' is not a valid network range" - run_once: true - -- name: "Check that kube_pods_subnet does not collide with kube_service_addresses" - assert: - that: - - kube_pods_subnet | ansible.utils.ipaddr(kube_service_addresses) | string == 'None' - msg: "kube_pods_subnet cannot be the same network segment as kube_service_addresses" - run_once: true - -- name: "Check that IP range is enough for the nodes" - assert: - that: - - 2 ** (kube_network_node_prefix - kube_pods_subnet | ansible.utils.ipaddr('prefix')) >= groups['k8s_cluster'] | length - msg: "Not enough IPs are available for the desired node count." - when: kube_network_plugin != 'calico' - run_once: true - -- name: Stop if unknown dns mode - assert: - that: dns_mode in ['coredns', 'coredns_dual', 'manual', 'none'] - msg: "dns_mode can only be 'coredns', 'coredns_dual', 'manual' or 'none'" - when: dns_mode is defined - run_once: true - -- name: Stop if unknown kube proxy mode - assert: - that: kube_proxy_mode in ['iptables', 'ipvs'] - msg: "kube_proxy_mode can only be 'iptables' or 'ipvs'" - when: kube_proxy_mode is defined - run_once: true - -- name: Stop if unknown cert_management - assert: - that: cert_management | d('script') in ['script', 'none'] - msg: "cert_management can only be 'script' or 'none'" - run_once: true - -- name: Stop if unknown resolvconf_mode - assert: - that: resolvconf_mode in ['docker_dns', 'host_resolvconf', 'none'] - msg: "resolvconf_mode can only be 'docker_dns', 'host_resolvconf' or 'none'" - when: resolvconf_mode is defined - run_once: true - -- name: Stop if etcd deployment type is not host, docker or kubeadm - assert: - that: etcd_deployment_type in ['host', 'docker', 'kubeadm'] - msg: "The etcd deployment type, 'etcd_deployment_type', must be host, docker or kubeadm" - when: - - inventory_hostname in groups.get('etcd',[]) - -- name: Stop if container manager is not docker, crio or containerd - assert: - that: container_manager in ['docker', 'crio', 'containerd'] - msg: "The container manager, 'container_manager', must be docker, crio or containerd" - run_once: true - -- name: Stop if etcd deployment type is not host or kubeadm when container_manager != docker - assert: - that: etcd_deployment_type in ['host', 'kubeadm'] - msg: "The etcd deployment type, 'etcd_deployment_type', must be host or kubeadm when container_manager is not docker" - when: - - inventory_hostname in groups.get('etcd',[]) - - container_manager != 'docker' - -# TODO: Clean this task up when we drop backward compatibility support for `etcd_kubeadm_enabled` -- name: Stop if etcd deployment type is not host or kubeadm when container_manager != docker and etcd_kubeadm_enabled is not defined - run_once: true - when: etcd_kubeadm_enabled is defined - block: - - name: Warn the user if they are still using `etcd_kubeadm_enabled` - debug: - msg: > - "WARNING! => `etcd_kubeadm_enabled` is deprecated and will be removed in a future release. - You can set `etcd_deployment_type` to `kubeadm` instead of setting `etcd_kubeadm_enabled` to `true`." - changed_when: true - - - name: Stop if `etcd_kubeadm_enabled` is defined and `etcd_deployment_type` is not `kubeadm` or `host` - assert: - that: etcd_deployment_type == 'kubeadm' - msg: > - It is not possible to use `etcd_kubeadm_enabled` when `etcd_deployment_type` is set to {{ etcd_deployment_type }}. - Unset the `etcd_kubeadm_enabled` variable and set `etcd_deployment_type` to desired deployment type (`host`, `kubeadm`, `docker`) instead." - when: etcd_kubeadm_enabled - -- name: Stop if download_localhost is enabled but download_run_once is not - assert: - that: download_run_once - msg: "download_localhost requires enable download_run_once" - when: download_localhost - -- name: Stop if kata_containers_enabled is enabled when container_manager is docker - assert: - that: container_manager != 'docker' - msg: "kata_containers_enabled support only for containerd and crio-o. See https://github.com/kata-containers/documentation/blob/1.11.4/how-to/run-kata-with-k8s.md#install-a-cri-implementation for details" - when: kata_containers_enabled - -- name: Stop if gvisor_enabled is enabled when container_manager is not containerd - assert: - that: container_manager == 'containerd' - msg: "gvisor_enabled support only compatible with containerd. See https://github.com/kubernetes-sigs/kubespray/issues/7650 for details" - when: gvisor_enabled + - upstream_dns_servers | length == 0 + - not disable_host_nameservers + - dns_mode in ['coredns', 'coredns_dual'] - name: Stop if download_localhost is enabled for Flatcar Container Linux assert: that: ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] msg: "download_run_once not supported for Flatcar Container Linux" when: download_run_once or download_force_cache - -- name: Ensure minimum containerd version - assert: - that: containerd_version is version(containerd_min_version_required, '>=') - msg: "containerd_version is too low. Minimum version {{ containerd_min_version_required }}" - run_once: true - when: - - containerd_version not in ['latest', 'edge', 'stable'] - - container_manager == 'containerd' - -- name: Stop if using deprecated containerd_config variable - assert: - that: containerd_config is not defined - msg: "Variable containerd_config is now deprecated. See https://github.com/kubernetes-sigs/kubespray/blob/master/inventory/sample/group_vars/all/containerd.yml for details." - when: - - containerd_config is defined - - not ignore_assert_errors - -- name: Stop if auto_renew_certificates is enabled when certificates are managed externally (kube_external_ca_mode is true) - assert: - that: not auto_renew_certificates - msg: "Variable auto_renew_certificates must be disabled when CA are managed externally: kube_external_ca_mode = true" - when: - - kube_external_ca_mode - - not ignore_assert_errors - -- name: Stop if using deprecated comma separated list for admission plugins - assert: - that: "',' not in kube_apiserver_enable_admission_plugins[0]" - msg: "Comma-separated list for kube_apiserver_enable_admission_plugins is now deprecated, use separate list items for each plugin." - when: - - kube_apiserver_enable_admission_plugins is defined - - kube_apiserver_enable_admission_plugins | length > 0 - -- name: Verify that the packages list structure is valid - ansible.utils.validate: - criteria: "{{ lookup('file', 'pkgs-schema.json') }}" - data: "{{ pkgs }}" - -- name: Verify that the packages list is sorted - vars: - pkgs_lists: "{{ pkgs.keys() | list }}" - assert: - that: "pkgs_lists | sort == pkgs_lists" - fail_msg: "pkgs is not sorted: {{ pkgs_lists | ansible.utils.fact_diff(pkgs_lists | sort) }}" diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0050-create_directories.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0050-create_directories.yml index 507a72d..d34028a 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0050-create_directories.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0050-create_directories.yml @@ -5,17 +5,17 @@ state: directory owner: "{{ kube_owner }}" mode: "0755" - when: inventory_hostname in groups['k8s_cluster'] + when: ('k8s_cluster' in group_names) become: true tags: - kubelet - - k8s-secrets - kube-controller-manager - kube-apiserver - - bootstrap-os + - bootstrap_os - apps - network - - master + - master # master tag is deprecated and replaced by control-plane + - control-plane - node with_items: - "{{ kube_config_dir }}" @@ -29,17 +29,17 @@ state: directory owner: root mode: "0755" - when: inventory_hostname in groups['k8s_cluster'] + when: ('k8s_cluster' in group_names) become: true tags: - kubelet - - k8s-secrets - kube-controller-manager - kube-apiserver - - bootstrap-os + - bootstrap_os - apps - network - - master + - master # master tag is deprecated and replaced by control-plane + - control-plane - node with_items: - "{{ kube_cert_dir }}" @@ -53,7 +53,7 @@ get_mime: false register: kube_cert_compat_dir_check when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - kube_cert_dir != kube_cert_compat_dir - name: Create kubernetes kubeadm compat cert dir (kubernetes/kubeadm issue 1498) @@ -63,7 +63,7 @@ state: link mode: "0755" when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - kube_cert_dir != kube_cert_compat_dir - not kube_cert_compat_dir_check.stat.exists @@ -78,7 +78,7 @@ - "/opt/cni/bin" when: - kube_network_plugin in ["calico", "weave", "flannel", "cilium", "kube-ovn", "kube-router", "macvlan"] - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) tags: - network - cilium @@ -86,7 +86,7 @@ - weave - kube-ovn - kube-router - - bootstrap-os + - bootstrap_os - name: Create calico cni directories file: @@ -98,11 +98,11 @@ - "/var/lib/calico" when: - kube_network_plugin == "calico" - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) tags: - network - calico - - bootstrap-os + - bootstrap_os - name: Create local volume provisioner directories file: @@ -113,7 +113,7 @@ mode: "{{ local_volume_provisioner_directory_mode }}" with_items: "{{ local_volume_provisioner_storage_classes.keys() | list }}" when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - local_volume_provisioner_enabled tags: - persistent_volumes diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml index 9aad0db..b7e9a1e 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml @@ -7,10 +7,9 @@ blockinfile: path: "{{ resolvconffile }}" block: |- - {% for item in [domainentry] + [searchentries] -%} - {{ item }} - {% endfor %} - {% for item in nameserverentries.split(',') %} + domain {{ dns_domain }} + search {{ (default_searchdomains + searchdomains) | join(' ') }} + {% for item in nameserverentries %} nameserver {{ item }} {% endfor %} options ndots:{{ ndots }} timeout:{{ dns_timeout | default('2') }} attempts:{{ dns_attempts | default('2') }} diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml index 6dfa724..8274989 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml @@ -4,11 +4,12 @@ path: /etc/NetworkManager/conf.d/dns.conf section: global-dns-domain-* option: servers - value: "{{ nameserverentries }}" + value: "{{ nameserverentries | join(',') }}" mode: '0600' - backup: true + backup: "{{ leave_etc_backup_files }}" when: - - nameserverentries != "127.0.0.53" or systemd_resolved_enabled.rc != 0 + - ('127.0.0.53' not in nameserverentries + or systemd_resolved_enabled.rc != 0) notify: Preinstall | update resolvconf for networkmanager - name: Set default dns if remove_default_searchdomains is false @@ -21,9 +22,9 @@ path: /etc/NetworkManager/conf.d/dns.conf section: global-dns option: searches - value: "{{ (default_searchdomains | default([]) + searchdomains | default([])) | join(',') }}" + value: "{{ (default_searchdomains | default([]) + searchdomains) | join(',') }}" mode: '0600' - backup: true + backup: "{{ leave_etc_backup_files }}" notify: Preinstall | update resolvconf for networkmanager - name: NetworkManager | Add DNS options to NM configuration @@ -33,5 +34,5 @@ option: options value: "ndots:{{ ndots }},timeout:{{ dns_timeout | default('2') }},attempts:{{ dns_attempts | default('2') }}" mode: '0600' - backup: true + backup: "{{ leave_etc_backup_files }}" notify: Preinstall | update resolvconf for networkmanager diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml index 8941a64..f1f742c 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml @@ -20,7 +20,7 @@ - "'Amazon' not in ansible_distribution" - slc.stat.exists tags: - - bootstrap-os + - bootstrap_os - name: Disable IPv6 DNS lookup lineinfile: @@ -28,13 +28,13 @@ line: "precedence ::ffff:0:0/96 100" state: present create: true - backup: true + backup: "{{ leave_etc_backup_files }}" mode: "0644" when: - disable_ipv6_dns - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] tags: - - bootstrap-os + - bootstrap_os - name: Clean previously used sysctl file locations file: @@ -52,7 +52,7 @@ get_mime: false register: sysctl_file_stat tags: - - bootstrap-os + - bootstrap_os - name: Change sysctl file path to link source if linked set_fact: @@ -61,7 +61,7 @@ - sysctl_file_stat.stat.islnk is defined - sysctl_file_stat.stat.islnk tags: - - bootstrap-os + - bootstrap_os - name: Make sure sysctl file path folder exists file: @@ -76,6 +76,7 @@ value: "1" state: present reload: true + when: ipv4_stack | bool - name: Enable ipv6 forwarding ansible.posix.sysctl: @@ -84,7 +85,7 @@ value: "1" state: present reload: true - when: enable_dual_stack_networks | bool + when: ipv6_stack | bool - name: Check if we need to set fs.may_detach_mounts stat: diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml index b1e2fee..7d41224 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml @@ -1,12 +1,4 @@ --- -- name: Ensure NTP package - package: - name: - - "{{ ntp_package }}" - state: present - when: - - not is_fedora_coreos - - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] - name: Disable systemd-timesyncd service: @@ -21,6 +13,8 @@ ntp_config_file: >- {% if ntp_package == "ntp" -%} /etc/ntp.conf + {%- elif ntp_package == "ntpsec" -%} + /etc/ntpsec/ntp.conf {%- elif ansible_os_family in ['RedHat', 'Suse'] -%} /etc/chrony.conf {%- else -%} @@ -56,10 +50,10 @@ # noqa: jinja[spacing] command: >- timeout -k 60s 60s - {% if ntp_package == "ntp" -%} - ntpd -gq - {%- else -%} + {% if ntp_package == "chrony" -%} chronyd -q + {%- else -%} + ntpd -gq {%- endif -%} when: - ntp_force_sync_immediately diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0090-etchosts.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0090-etchosts.yml index 0b44d26..2952a63 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0090-etchosts.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0090-etchosts.yml @@ -2,11 +2,10 @@ - name: Hosts | create hosts list from inventory set_fact: etc_hosts_inventory_block: |- - {% for item in (groups['k8s_cluster'] + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique -%} - {% if 'access_ip' in hostvars[item] or 'ip' in hostvars[item] or 'ansible_default_ipv4' in hostvars[item] -%} - {{ hostvars[item]['access_ip'] | default(hostvars[item]['ip'] | default(hostvars[item]['ansible_default_ipv4']['address'])) }} - {%- if ('ansible_hostname' in hostvars[item] and item != hostvars[item]['ansible_hostname']) %} {{ hostvars[item]['ansible_hostname'] }}.{{ dns_domain }} {{ hostvars[item]['ansible_hostname'] }} {% else %} {{ item }}.{{ dns_domain }} {{ item }} {% endif %} - + {% for item in (groups['k8s_cluster'] + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique %} + {{ hostvars[item]['main_access_ip'] }} {{ hostvars[item]['ansible_hostname'] | default(item) }}.{{ dns_domain }} {{ hostvars[item]['ansible_hostname'] | default(item) }} + {% if ipv4_stack and ipv6_stack %} + {{ hostvars[item]['access_ip6'] | default(hostvars[item]['ip6'] | default(hostvars[item]['ansible_default_ipv6']['address'])) }} {{ hostvars[item]['ansible_hostname'] | default(item) }}.{{ dns_domain }} {{ hostvars[item]['ansible_hostname'] | default(item) }} {% endif %} {% endfor %} delegate_to: localhost @@ -20,7 +19,7 @@ block: "{{ hostvars.localhost.etc_hosts_inventory_block }}" state: "{{ 'present' if populate_inventory_to_hosts_file else 'absent' }}" create: true - backup: true + backup: "{{ leave_etc_backup_files }}" unsafe_writes: true marker: "# Ansible inventory hosts {mark}" mode: "0644" @@ -31,7 +30,7 @@ regexp: ".*{{ apiserver_loadbalancer_domain_name }}$" line: "{{ loadbalancer_apiserver.address }} {{ apiserver_loadbalancer_domain_name }}" state: present - backup: true + backup: "{{ leave_etc_backup_files }}" unsafe_writes: true when: - populate_loadbalancer_apiserver_to_hosts_file @@ -69,7 +68,7 @@ line: "{{ item.key }} {{ item.value | join(' ') }}" regexp: "^{{ item.key }}.*$" state: present - backup: true + backup: "{{ leave_etc_backup_files }}" unsafe_writes: true loop: "{{ etc_hosts_localhosts_dict_target | default({}) | dict2items }}" diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml index 9745ab2..7daa878 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml @@ -1,15 +1,20 @@ --- - name: Configure dhclient to supersede search/domain/nameservers blockinfile: + # 1 is the 2nd item of a tuple in items() block: |- - {% for item in [supersede_domain, supersede_search, supersede_nameserver] | reject('equalto', '') -%} - {{ item }} + {% for key, val in dhclient_supersede.items() | rejectattr(1, '==', []) -%} + {% if key == "domain-name-servers" -%} + supersede {{ key }} {{ val | join(',') }}; + {% else -%} + supersede {{ key }} "{{ val | join('","') }}"; + {% endif -%} {% endfor %} path: "{{ dhclientconffile }}" create: true state: present insertbefore: BOF - backup: true + backup: "{{ leave_etc_backup_files }}" marker: "# Ansible entries {mark}" mode: "0644" notify: Preinstall | propagate resolvconf to k8s components diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0110-dhclient-hooks-undo.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/0110-dhclient-hooks-undo.yml index dd320d5..0bc23c1 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0110-dhclient-hooks-undo.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/0110-dhclient-hooks-undo.yml @@ -7,7 +7,7 @@ blockinfile: path: "{{ dhclientconffile }}" state: absent - backup: true + backup: "{{ leave_etc_backup_files }}" marker: "# Ansible entries {mark}" notify: Preinstall | propagate resolvconf to k8s components diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/main.yml b/kubespray/project/roles/kubernetes/preinstall/tasks/main.yml index a645080..7179e3d 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/main.yml +++ b/kubespray/project/roles/kubernetes/preinstall/tasks/main.yml @@ -32,7 +32,7 @@ - systemd_resolved_enabled.rc != 0 - networkmanager_enabled.rc != 0 tags: - - bootstrap-os + - bootstrap_os - resolvconf - name: Apply systemd-resolved settings @@ -42,7 +42,7 @@ - resolvconf_mode == 'host_resolvconf' - systemd_resolved_enabled.rc == 0 tags: - - bootstrap-os + - bootstrap_os - resolvconf - name: Apply networkmanager unmanaged devices settings @@ -50,7 +50,7 @@ when: - networkmanager_enabled.rc == 0 tags: - - bootstrap-os + - bootstrap_os - name: Apply networkmanager DNS settings import_tasks: 0063-networkmanager-dns.yml @@ -59,23 +59,15 @@ - resolvconf_mode == 'host_resolvconf' - networkmanager_enabled.rc == 0 tags: - - bootstrap-os + - bootstrap_os - resolvconf -- name: Install required system packages - import_tasks: 0070-system-packages.yml - when: - - not dns_late - tags: - - bootstrap-os - - system-packages - - name: Apply system configurations import_tasks: 0080-system-configurations.yml when: - not dns_late tags: - - bootstrap-os + - bootstrap_os - name: Configure NTP import_tasks: 0081-ntp-configurations.yml @@ -83,12 +75,12 @@ - not dns_late - ntp_enabled tags: - - bootstrap-os + - bootstrap_os - name: Configure /etc/hosts import_tasks: 0090-etchosts.yml tags: - - bootstrap-os + - bootstrap_os - etchosts - name: Configure dhclient @@ -99,7 +91,7 @@ - dhclientconffile is defined - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] tags: - - bootstrap-os + - bootstrap_os - resolvconf - name: Configure dhclient dhclient hooks @@ -110,7 +102,7 @@ - dhclientconffile is defined - not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] tags: - - bootstrap-os + - bootstrap_os - resolvconf # We need to make sure the network is restarted early enough so that docker can later pick up the correct system @@ -128,7 +120,7 @@ when: - not dns_late tags: - - bootstrap-os + - bootstrap_os - name: Run calico checks include_role: diff --git a/kubespray/project/roles/kubernetes/preinstall/templates/resolved.conf.j2 b/kubespray/project/roles/kubernetes/preinstall/templates/resolved.conf.j2 index edafbf9..85f0246 100644 --- a/kubespray/project/roles/kubernetes/preinstall/templates/resolved.conf.j2 +++ b/kubespray/project/roles/kubernetes/preinstall/templates/resolved.conf.j2 @@ -1,12 +1,12 @@ [Resolve] {% if not dns_early and dns_late %} -DNS={{ ([nodelocaldns_ip] if enable_nodelocaldns else coredns_server )| list | join(' ') }} +DNS={{ ([nodelocaldns_ip] if enable_nodelocaldns else coredns_server) | list | join(' ') }} {% endif %} -FallbackDNS={{ ( upstream_dns_servers|d([]) + nameservers|d([]) + cloud_resolver|d([])) | unique | join(' ') }} -{% if remove_default_searchdomains and searchdomains|default([])|length != 0 %} -Domains={{ searchdomains|default([]) | join(' ') }} +FallbackDNS={{ ( upstream_dns_servers + nameservers + cloud_resolver) | unique | join(' ') }} +{% if remove_default_searchdomains and searchdomains | length != 0 %} +Domains={{ searchdomains | join(' ') }} {% else %} -Domains={{ ([ 'default.svc.' + dns_domain, 'svc.' + dns_domain ] + searchdomains|default([])) | join(' ') }} +Domains={{ ([ 'default.svc.' + dns_domain, 'svc.' + dns_domain ] + searchdomains) | join(' ') }} {% endif %} DNSSEC=no Cache=no-negative diff --git a/kubespray/project/roles/kubernetes/preinstall/vars/main.yml b/kubespray/project/roles/kubernetes/preinstall/vars/main.yml index e788b5d..b7da665 100644 --- a/kubespray/project/roles/kubernetes/preinstall/vars/main.yml +++ b/kubespray/project/roles/kubernetes/preinstall/vars/main.yml @@ -1,103 +1,22 @@ --- -pkgs: - apparmor: &debian_family_base - os: - families: - - Debian - apt-transport-https: *debian_family_base - aufs-tools: &deb_10 - groups: - - k8s_cluster - os: - distributions: - Debian: - major_versions: - - "10" - bash-completion: {} - conntrack: &deb_redhat - groups: - - k8s_cluster - os: - families: - - Debian - - RedHat - conntrack-tools: - groups: - - k8s_cluster - os: - families: - - Suse - distributions: - Amazon: {} - container-selinux: &redhat_family - groups: - - k8s_cluster - os: - families: - - RedHat - curl: {} - device-mapper: - groups: - - k8s_cluster - os: - families: - - Suse - device-mapper-libs: *redhat_family - e2fsprogs: {} - ebtables: {} - gnupg: &debian - groups: - - k8s_cluster - os: - distributions: - Debian: - major_versions: - - "11" - - "12" - ipset: - enabled: "{{ kube_proxy_mode != 'ipvs' }}" - groups: - - k8s_cluster - iptables: *deb_redhat - ipvsadm: - enabled: "{{ kube_proxy_mode == 'ipvs' }}" - groups: - - k8s_cluster - libseccomp: *redhat_family - libseccomp2: - groups: - - k8s_cluster - os: - families: - - Suse - - Debian - libselinux-python: # TODO: Handle rehat_family + major < 8 - os: - distributions: - Amazon: {} - libselinux-python3: - os: - distributions: - Fedora: {} - mergerfs: - os: - distributions: - Debian: - major_versions: - - "12" - nss: *redhat_family - openssl: {} - python-apt: *deb_10 - # TODO: not for debian 10 - python3-apt: *debian_family_base - python3-libselinux: - os: - distributions: - RedHat: {} - CentOS: {} - rsync: {} - socat: {} - software-properties-common: *debian_family_base - tar: {} - unzip: {} - xfsprogs: {} +coredns_server_by_mode: + coredns: "{{ [skydns_server] }}" + coredns_dual: "{{ [skydns_server, skydns_server_secondary] }}" + manual: "{{ manual_dns_server.split(',') }}" + none: [] +coredns_server: "{{ upstream_dns_servers if dns_early else coredns_server_by_mode[dns_mode] }}" + +_nameserverentries: + late: + - "{{ nodelocaldns_ip if enable_nodelocaldns else coredns_server }}" + early: + - "{{ nameservers }}" + - "{{ cloud_resolver }}" + - "{{ configured_nameservers if not disable_host_nameservers else [] }}" +nameserverentries: "{{ ((_nameserverentries['late'] if not dns_early else []) + _nameserverentries['early']) | flatten | unique }}" +dhclient_supersede: + domain-name-servers: "{{ ([nameservers, cloud_resolver] | flatten | unique) if dns_early else nameserverentries }}" + domain-name: "{{ [dns_domain] }}" + domain-search: "{{ default_searchdomains + searchdomains }}" +configured_nameservers: "{{ (resolvconf_slurp.content | b64decode | regex_findall('^nameserver\\s*(\\S*)', multiline=True) | ansible.utils.ipaddr) + if resolvconf_stat.stat.exists else [] }}" diff --git a/kubespray/project/roles/kubernetes/tokens/files/kube-gen-token.sh b/kubespray/project/roles/kubernetes/tokens/files/kube-gen-token.sh deleted file mode 100644 index 121b522..0000000 --- a/kubespray/project/roles/kubernetes/tokens/files/kube-gen-token.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -token_dir=${TOKEN_DIR:-/var/srv/kubernetes} -token_file="${token_dir}/known_tokens.csv" - -create_accounts=($@) - -if [ ! -e "${token_file}" ]; then - touch "${token_file}" -fi - -for account in "${create_accounts[@]}"; do - if grep ",${account}," "${token_file}" ; then - continue - fi - token=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null) - echo "${token},${account},${account}" >> "${token_file}" - echo "${token}" > "${token_dir}/${account}.token" - echo "Added ${account}" -done diff --git a/kubespray/project/roles/kubernetes/tokens/tasks/check-tokens.yml b/kubespray/project/roles/kubernetes/tokens/tasks/check-tokens.yml deleted file mode 100644 index d8bb203..0000000 --- a/kubespray/project/roles/kubernetes/tokens/tasks/check-tokens.yml +++ /dev/null @@ -1,41 +0,0 @@ ---- -- name: "Check_tokens | check if the tokens have already been generated on first master" - stat: - path: "{{ kube_token_dir }}/known_tokens.csv" - get_attributes: false - get_checksum: true - get_mime: false - delegate_to: "{{ groups['kube_control_plane'][0] }}" - register: known_tokens_master - run_once: true - -- name: "Check_tokens | Set default value for 'sync_tokens' and 'gen_tokens' to false" - set_fact: - sync_tokens: false - gen_tokens: false - -- name: "Check_tokens | Set 'sync_tokens' and 'gen_tokens' to true" - set_fact: - gen_tokens: true - when: not known_tokens_master.stat.exists and kube_token_auth | default(true) - run_once: true - -- name: "Check tokens | check if a cert already exists" - stat: - path: "{{ kube_token_dir }}/known_tokens.csv" - get_attributes: false - get_checksum: true - get_mime: false - register: known_tokens - -- name: "Check_tokens | Set 'sync_tokens' to true" - set_fact: - sync_tokens: >- - {%- set tokens = {'sync': False} -%} - {%- for server in groups['kube_control_plane'] | intersect(ansible_play_batch) - if (not hostvars[server].known_tokens.stat.exists) or - (hostvars[server].known_tokens.stat.checksum | default('') != known_tokens_master.stat.checksum | default('')) -%} - {%- set _ = tokens.update({'sync': True}) -%} - {%- endfor -%} - {{ tokens.sync }} - run_once: true diff --git a/kubespray/project/roles/kubernetes/tokens/tasks/gen_tokens.yml b/kubespray/project/roles/kubernetes/tokens/tasks/gen_tokens.yml deleted file mode 100644 index a64aea9..0000000 --- a/kubespray/project/roles/kubernetes/tokens/tasks/gen_tokens.yml +++ /dev/null @@ -1,63 +0,0 @@ ---- -- name: Gen_tokens | copy tokens generation script - copy: - src: "kube-gen-token.sh" - dest: "{{ kube_script_dir }}/kube-gen-token.sh" - mode: "0700" - run_once: true - delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: gen_tokens | default(false) - -- name: Gen_tokens | generate tokens for master components - command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}" - environment: - TOKEN_DIR: "{{ kube_token_dir }}" - with_nested: - - [ "system:kubectl" ] - - "{{ groups['kube_control_plane'] }}" - register: gentoken_master - changed_when: "'Added' in gentoken_master.stdout" - run_once: true - delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: gen_tokens | default(false) - -- name: Gen_tokens | generate tokens for node components - command: "{{ kube_script_dir }}/kube-gen-token.sh {{ item[0] }}-{{ item[1] }}" - environment: - TOKEN_DIR: "{{ kube_token_dir }}" - with_nested: - - [ 'system:kubelet' ] - - "{{ groups['kube_node'] }}" - register: gentoken_node - changed_when: "'Added' in gentoken_node.stdout" - run_once: true - delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: gen_tokens | default(false) - -- name: Gen_tokens | Get list of tokens from first master - command: "find {{ kube_token_dir }} -maxdepth 1 -type f" - register: tokens_list - check_mode: false - delegate_to: "{{ groups['kube_control_plane'][0] }}" - run_once: true - when: sync_tokens | default(false) - -- name: Gen_tokens | Gather tokens - shell: "set -o pipefail && tar cfz - {{ tokens_list.stdout_lines | join(' ') }} | base64 --wrap=0" - args: - executable: /bin/bash - register: tokens_data - check_mode: false - delegate_to: "{{ groups['kube_control_plane'][0] }}" - run_once: true - when: sync_tokens | default(false) - -- name: Gen_tokens | Copy tokens on masters - shell: "set -o pipefail && echo '{{ tokens_data.stdout | quote }}' | base64 -d | tar xz -C /" - args: - executable: /bin/bash - when: - - inventory_hostname in groups['kube_control_plane'] - - sync_tokens | default(false) - - inventory_hostname != groups['kube_control_plane'][0] - - tokens_data.stdout diff --git a/kubespray/project/roles/kubernetes/tokens/tasks/main.yml b/kubespray/project/roles/kubernetes/tokens/tasks/main.yml deleted file mode 100644 index cab5a06..0000000 --- a/kubespray/project/roles/kubernetes/tokens/tasks/main.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- - -- name: Check tokens - import_tasks: check-tokens.yml - tags: - - k8s-secrets - - k8s-gen-tokens - - facts - -- name: Make sure the tokens directory exits - file: - path: "{{ kube_token_dir }}" - state: directory - mode: "0644" - group: "{{ kube_cert_group }}" - -- name: Generate tokens - import_tasks: gen_tokens.yml - tags: - - k8s-secrets - - k8s-gen-tokens diff --git a/kubespray/project/roles/kubespray-defaults/defaults/main/checksums.yml b/kubespray/project/roles/kubespray-defaults/defaults/main/checksums.yml deleted file mode 100644 index d1096cd..0000000 --- a/kubespray/project/roles/kubespray-defaults/defaults/main/checksums.yml +++ /dev/null @@ -1,1228 +0,0 @@ ---- -crictl_checksums: - arm: - v1.30.0: 0 - v1.29.0: 0 - v1.28.0: 1ea267f3872f4b7f311963ab43ce6653ceeaf8727206c889b56587c95497e9dd - arm64: - v1.30.0: 3769043fc6018a9e1697fcb768bb89ecd429176bd71e849058916f79a46a07a8 - v1.29.0: 0b615cfa00c331fb9c4524f3d4058a61cc487b33a3436d1269e7832cf283f925 - v1.28.0: 06e9224e42bc5e23085751e93cccdac89f7930ba6f7a45b8f8fc70ef663c37c4 - amd64: - v1.30.0: 3dd03954565808eaeb3a7ffc0e8cb7886a64a9aa94b2bfdfbdc6e2ed94842e49 - v1.29.0: d16a1ffb3938f5a19d5c8f45d363bd091ef89c0bc4d44ad16b933eede32fdcbb - v1.28.0: 8dc78774f7cbeaf787994d386eec663f0a3cf24de1ea4893598096cb39ef2508 - ppc64le: - v1.30.0: ada550cecb5647014f16dd3ff6c59d7ef7d942ca8cb6c51c15ed019622f39ee9 - v1.29.0: 2803a1865045077f29f798b9c569e1db7d44b5c329a546a0fd183e906925b99f - v1.28.0: b70fb7bee5982aa1318ba25088319f1d0d1415567f1f76cd69011b8a14da4daf -crio_archive_checksums: - arm: - v1.30.3: 0 - v1.30.2: 0 - v1.30.1: 0 - v1.30.0: 0 - v1.29.2: 0 - v1.29.1: 0 - v1.29.0: 0 - v1.28.4: 0 - v1.28.3: 0 - v1.28.2: 0 - v1.28.1: 0 - v1.28.0: 0 - arm64: - v1.30.3: 2e47b4b307788b15263256e0e423574c60eec80e17576704df736a7ccc13d7bd - v1.30.2: 6c0ed1a8a38c65fda45d8b725b8742d247e9f658d8cd6c56baa05bd749b9ccbe - v1.30.1: 371a6da24dfc7c9e01f29191b36a0629474a37cd8300fa8a36483647a7859b72 - v1.30.0: 7e7c934cebff6433594e4cdc440e1ceb5602741a35d74b2342dac6fb585c3549 - v1.29.2: e2ddaeb9d46b6a39057e67f77f5840e79d2226839014d77eb6ef243b88761f7a - v1.29.1: f7d7ca187b44ec490f4511e32f5a6bdf2d5ff14fb3dd1b452e330d7369e69c29 - v1.29.0: 2bf11aeb85362ce4b25a7d9fc17bbe80659013425430e5efb922b4388031a027 - v1.28.4: de110f71160202a1183bd3282a0a480363e6851ee101bbcaa34ba2e38c3b924d - v1.28.3: 05c98df0a3cc1fe9eec37b4fbf7c74c63f72fdbb4e9df56cf86db42a7b9fd879 - v1.28.2: 178bd67abae247d077168d9ff29c7abeae9b8427a6f9c33793b0ddb98ced2859 - v1.28.1: 98a96c6b6bdf20c60e1a7948847c28b57d9e6e47e396b2e405811ea2c24ab9dc - v1.28.0: c8ea800244d9e4ce74af85126afadea2939cd6f7ddd152d0f09fafbf294ef1cc - amd64: - v1.30.3: 622809ec7e21350a3ff7897c7d2cabdf4367b1a5904d346514adc485de3c7172 - v1.30.2: 10be07d2626a093b58a29110e84256029d4c46aeb06a6b41e8bddc30bcfcaa4b - v1.30.1: 7293f51295d89106e59fe0f83af9599e71fe4f446e1b13c40687ef63ecc1b194 - v1.30.0: c2b189febc9f9cb51f84eecad0da955182e31b98a9f456314546bb83ee2a901a - v1.29.2: 55e71ef1bceb1cd9490ec85fdbfc889d3f3a9dd2ef3b8954dcbcf33cb6609167 - v1.29.1: 127ca9f57c2a3ad44dde2e64e0ec94169886245dffb74c12e68eedc80756c260 - v1.29.0: 79c161d8db8ee7f0f4807d6232283d481ef0c20c514b61289238258f66734ac6 - v1.28.4: 4bf81791f6d5f65df797f4e25dee0c8fcc157c2800c0159c68c943fd78d63e30 - v1.28.3: 76c25d00f14f2297b68f5b71be6b80766b5235c4ba8972aff8d841a355e4d10c - v1.28.2: f3b82e7330bca2a8b833502c59f21ad26b9bdef7a5d98358293cea1ae62a796b - v1.28.1: 63cee2e67e283e29d790caa52531bcca7bc59473fb73bde75f4fd8daa169d4bf - v1.28.0: fa87497c12815766d18f332b38a4d823fa6ad6bb3d159e383a5557e6c912eb3b - ppc64le: - v1.30.3: 44ed039a1c0c492b14212bbe59c63fe804e3cc525102f47475a5bc0ffd08f4e8 - v1.30.2: 19169b1ef3324c749a0b0105b47288c0ef4949964b340c85229d00234e6148a1 - v1.30.1: e6fb05de749a06316d046e46f8ff4345a413264e63f63dc9e3f1db2cb8a7c962 - v1.30.0: e6fe5c39fa7b7cf8167bb59b94dc9028f8def0c4fec4c1c9028ec4b84da6c53a - v1.29.2: 6577d1476124bcd6bcfd25419bb0d1dc01585dc6e8246a986a7769ad2af407fa - v1.29.1: e26613e038d48271ad83877e5db5ad6f2116181d202495de849d378ab4a76062 - v1.29.0: 8adddaf6cf0ed2905820dc162ca5ef541baa7b251368ee00c75435a872a886fb - v1.28.4: 98ddbe8469ebaccab91f286c06b97024c31277e4b6664d162fa6c62f6d7f6366 - v1.28.3: c952aafe98dd55038525e3abc461152c0fcd758a50b0cbd8a0adc0eba2632dea - v1.28.2: 319e413d513bcb649244333881830d2eaccfb2bb77553baf9be3fa6118a70209 - v1.28.1: 7d22ba73a04e6b64088f82b37c03f1c5891e7c0847eeabeaeb83597a87b85292 - v1.28.0: ffcb7cb90c0a616bf642ea02361d18007a227393f7348c4dfdcbc370d6fff98e -# Checksum -# Kubernetes versions above Kubespray's current target version are untested and should be used with caution. -kubelet_checksums: - arm: - v1.30.4: 0 - v1.30.3: 0 - v1.30.2: 0 - v1.30.1: 0 - v1.30.0: 0 - v1.29.7: 0 - v1.29.6: 0 - v1.29.5: 0 - v1.29.4: 0 - v1.29.3: 0 - v1.29.2: 0 - v1.29.1: 0 - v1.29.0: 0 - v1.28.12: 0 - v1.28.11: 0 - v1.28.10: 0 - v1.28.9: 0 - v1.28.8: 0 - v1.28.7: 0 - v1.28.6: 0 - v1.28.5: 0 - v1.28.4: 0 - v1.28.3: 0 - v1.28.2: 0 - v1.28.1: 0 - v1.28.0: 0 - arm64: - v1.30.4: d3df7a4acff9aba5518930b9c417e8e0ca8cf5e105b7fee6504891fa8f3e962a - v1.30.3: 41d1926cd7b9c7c250c45f11c8fa9d1946cae98aec2eefc61a2cb4933612bcce - v1.30.2: 72ceb082311b42032827a936f80cd2437b8eee03053d05dbe36ba48585febfb8 - v1.30.1: c45049b829af876588ec1a30def3884ce77c2c175cd77485d49c78d2064a38fb - v1.30.0: fa887647422d34f3c7cc5b30fefcf97084d2c3277eff237c5808685ba8e4b15a - v1.29.7: f088079f26fb3bffc8a1c467e1caa5ad807023b63e70013e874163df87be6829 - v1.29.6: 0f0fa9429d0bcf04f271dcf4f666582dd4a4b15d6f116a45f17b5fcda90c2d2c - v1.29.5: 0d4328a3c67e4f0dbf270fa49343f3eab9316adde1a1bd2a857fa56876a9aff1 - v1.29.4: dc4bb6ea6cd35b024d63cc20d1c1800a9c695bd6f70411c57358d7c407513b00 - v1.29.3: 891dce19ed0eae34050c2eca0454204892e97bfe1a926f988cd044a987a9c7c9 - v1.29.2: 9b4aa572d4cd51a41b1067161d961423d0d12b120fb636ea887a12a975d4b19a - v1.29.1: e46417ab1ceae995f0e00d4177959a36ed34b807829422bc9dda70b263fe5c5d - v1.29.0: 0e0e4544c2a0a3475529154b7534d0d58683466efa04a2bb2e763b476db0bb16 - v1.28.12: 8e28fda6ab1bd506ca4090a0a617aa29d9988c7e23711e70819497089ba67388 - v1.28.11: 0e01c1393f8746965994431b70a20c32b8547dfb1dcf2770cb692990fc65ba5f - v1.28.10: feae161e374ee0155b5263cda339f30f16b525631535a003be7aa437661e1580 - v1.28.9: 312471ad255acfcdeea2c5849b171467af4518e96d69d727a3197ff334e9299d - v1.28.8: 90d61f40b7bb061b0fc6d08b8b9ddae51f90863c899b098e19eaa89dc855f2c0 - v1.28.7: e2c98b39b0b0745ef3e30febaeb8eaaf31ec721012405bd0dcf25e84026c221e - v1.28.6: ee2c060deff330d3338e24aec9734c9e5d5aea4fea1905c0795bccff6997a65e - v1.28.5: 28ddb696eb6e076f2a2f59ccaa2e409785a63346e5bda819717c6e0f58297702 - v1.28.4: bf203989dd9b3987b8a0d2331dcce6319f834b57df810fafba5a4805d54823ac - v1.28.3: 64f56e9c55183919153fe59df2c9015dff09c56de13a3cbccc0f04a95b76dab9 - v1.28.2: 32269e9ec38c561d028b65c3048ea6a100e1292cbe9e505565222455c8096577 - v1.28.1: 9b7fa64b2785da4a38768377961e227f8da629c56a5df43ca1b665dd07b56f3c - v1.28.0: 05dd12e35783cab4960e885ec0e7d0e461989b94297e7bea9018ccbd15c4dce9 - amd64: - v1.30.4: 0c02c0f997b3e9769eae7ca051856054411fca947b3d5409d991ce1964dd0e69 - v1.30.3: 9a37ddd5ea026639b7d85e98fa742e392df7aa5ec917bed0711a451613de3c1c - v1.30.2: 6923abe67ef069afca61c71c585023840426e802b198298055af3a82e11a4e52 - v1.30.1: 87bd6e5de9c0769c605da5fedb77a35c8b764e3bda1632447883c935dcf219d3 - v1.30.0: 32a32ec3d7e7f8b2648c9dd503ce9ef63b4af1d1677f5b5aed7846fb02d66f18 - v1.29.7: f16329e64f5b2204c1cb906f694abebb7f6869d56e6e8b60b54afa0057006b84 - v1.29.6: a946789d4fef64e6f5905dbd7dca01d4c3abd302d0da7958fdaa924fe2729c0b - v1.29.5: 261dc3f3c384d138835fe91a02071c642af94abb0cca56ebc04719240440944c - v1.29.4: 58571f0ed62543a9bbac541e52c15d8385083113a463e23aec1341d0b5043939 - v1.29.3: d8b55a2f8a87c8cd2cbf867d76d1d7f98b7198a740db19bad6ed7b8b813de771 - v1.29.2: f71a85039b71fe08f1c063a93d61a1c952dc8f9a8c6be9b13fbdac8f0d9ff960 - v1.29.1: 1b1975c58d38be1a99a8bcba4564ac489afd223b0abe9f2ab08bbde89d2412a3 - v1.29.0: e1c38137db8d8777eed8813646b59bf4d22d19b9011ab11dc28e2e34f6b80a05 - v1.28.12: 4648ae155b1ab05ab8dbef417bde4d5acfcd5ad32e8d1e3209006b40c440a56c - v1.28.11: 230f0634ea42a54a6c96771f12eecd6cadfe0b76ab41c3bc39aa7cbbe4dfb12e - v1.28.10: a361e744aaeef4539f0636ecd1827c85207a5f2b0c2b0a98dbbce1498061f509 - v1.28.9: f3af46cff11c675a80d91ebb38ebc4e85a9f813ce93e56ee131e7fea1491b786 - v1.28.8: 049b412a5861255cd3922f612acb79ab51135e166c5d80acf12fba9179eebf0c - v1.28.7: 120b1495babc4364f7e16a9d0f8b8e6b6f78316d047e4f6de77b5569b05813c7 - v1.28.6: 8506df1f20a5f8bba0592f5a4cf5d0cc541047708e664cb88580735400d0b26f - v1.28.5: bf37335da58182783a8c63866ec1f895b4c436e3ed96bdd87fe3f8ae8004ba1d - v1.28.4: db2a473b73c3754d4011590f2f0aa877657608499590c6b0f8b40bec96a3e9ba - v1.28.3: a3a058b4ba30da01ffe1801cd38fcad58a9022a2d39e080b4b2e0e9749a75ad5 - v1.28.2: 17edb866636f14eceaad58c56eab12af7ab3be3c78400aff9680635d927f1185 - v1.28.1: 2bc22332f44f8fcd3fce57879fd873f977949ebd261571fbae31fbb2713a5dd3 - v1.28.0: bfb6b977100963f2879a33e5fbaa59a5276ba829a957a6819c936e9c1465f981 - ppc64le: - v1.30.4: 50ea965747f3f8c69288aa9268e5c2cc1eb6c3f0b3efa7eba862258bd225d98d - v1.30.3: c48df46a72ff9764fd1bc54e99b6154772031b1e66c36b0ac5764a5801eadfc0 - v1.30.2: 268dfbb7ee3abcb8ff9fd0a88f81204e40dd33d177f7878941c9ff6b7cca0474 - v1.30.1: 1ac58eae0aa02fefad47d2318bfa5846ae0d7d11a5b691850cd86b2b614ceffe - v1.30.0: 8d4aa6b10bcddae9a7c754492743cfea88c1c6a4628cab98cdd29bb18d505d03 - v1.29.7: 52a70e6c9cab9f123cc0f2677b65ac6426cfc549d375c64008b43bcb8fae1d76 - v1.29.6: 77c2256d6863ac0e33a0e8e8c4cc798618ae73aac91b4f18b9e87d8e62973c61 - v1.29.5: b0caa52184a3e89a7f529c776ebabd7d34aecad560614f787fe08cff777a43cb - v1.29.4: 1ecc89b6f17df357835e3e56f553ec27f2aea69a5865dfb39cff77e6e70e6adb - v1.29.3: 811f2b17f443cd694b8650f5ec2c7e3a59394f8bf3e25d16182549aaab16a420 - v1.29.2: b0eb5e0362a4e153ed1239c65b0abb02b2d9fbbca6846d0bab8b285de8c84fca - v1.29.1: 467d2b457205363f53f72081295ea390fc25215b0ccc29dc04c4f82925266067 - v1.29.0: 67f09f866d3e4aee8211ce9887ec8bc427b188474a882a7af999fc0fee939028 - v1.28.12: d22af902a74d8d257ea508e9e6f91574e6e0e50006868a1943c47144dd3f9615 - v1.28.11: 35daf1aacafd035420d85052b037bc0aa1eec9193100c40f626aa3b140d4d48d - v1.28.10: 0ba43fda35f588eaf65955481a7c6f633e4e787a45322bf55a7558ece4944e39 - v1.28.9: cf33fbff3fb852ce9f8afda8818381af343fb5e7d30dde72999cc0d273631815 - v1.28.8: f3e4551e5234d296344a481196e607d88581705fedd561e8c807db1de8a9cc4b - v1.28.7: c67277445af9a97a375da3caa6a7dae7bb52fa454deb811c5bc89c2838b3322f - v1.28.6: 8f79f40bef88aaedfdf7256de48a972295b0069ae0ddefa90dff3f8690c825ce - v1.28.5: ae9fe81804ba67ee81e8a5fe1dc18fe285267764c61f831886a25245a11d8528 - v1.28.4: d79c97811fb10c1b1f48b69573f1164f108630631d9dba0d991fe924bd305f20 - v1.28.3: f20cfb8c9de73cdc66fbbecd03bb936ce57fe86ebced8ea93aa64ebda0235c21 - v1.28.2: 79f568ac700d29f88d669c6b6a09adb3b726bdd13c10aa0839cbc70b414372e5 - v1.28.1: 547fc76f0c1d78352fad841ebeacd387fe48750b2648565dfd49197621622fbb - v1.28.0: 22de59965f2d220afa24bf04f4c6d6b65a4bb1cd80756c13381973b1ac3b4578 -kubectl_checksums: - arm: - v1.30.4: a31676f522cc745f241b1fd5755b9965558e4f1f5db5149319439a15f49806d1 - v1.30.3: f9147ca81cbcb7b1cf41b75d95a0fd3597defb7c0e6db8c54e6ca7f493929c71 - v1.30.2: 2dab982920d87bc9a17c539bfa4f94b758afc454bb044029dee06144e8dbee08 - v1.30.1: b05c4c4b1c440e8797445b8b15e9f4a00010f1365533a2420b9e68428da19d89 - v1.30.0: ff54e96c73f4b87d740768f77edada7df8f2003f278d3c79bbbaa047b1fc708d - v1.29.7: cf875cbbdca7ea0e190075c7a4b3f2fa59864079c1fe9da482f8806b1ad64364 - v1.29.6: 7762244b8da5564d2ee6a65403dd3aa3f94e8e9b16887c51936a4e941de8fd95 - v1.29.5: f3c83a9674098c5a4f27defed001934719f487897dd61db1992057e5ed103b3e - v1.29.4: ff4a1f437dc902b73505841a7705a6405694856a798e962ec2fdf7793f0aeadb - v1.29.3: 12f72bd88eaa04cd8f09827c64195a695fdd5fb64e11c98524c83d21bcb0e37a - v1.29.2: f1bab202f0ce0c4209af0a977fc3dd4076397b1983544e09942ca4f586dff900 - v1.29.1: a4b478cc0e9adaab0c5bb3627c20c5228ea0fe2aeff9e805d611eb3edb761972 - v1.29.0: a2388eb458d07ec734e4fa02fd0147456a1922a7d6b8e67a32db9d64a4d7621c - v1.28.12: 54d5c9c302a93daec427ff4f20f50124bb0eaa99c1c477b49e78893d7c9ff1d3 - v1.28.11: 2710129489d782a35c5273202a7148aac42e316c5117aa89c64a8cc62f9ce140 - v1.28.10: e7b977779169f394383696afe872f6f0a4274789adbce1b70f5b28a20ee2cbd0 - v1.28.9: 2da7aead4f58aefee6892b2cc8184de26ef7808bf2d599553267d5cdbc1ce83a - v1.28.8: 98c44038dd978a58aa01849c25c2bd522fab7494a39bb3fd56c90944ba6e872f - v1.28.7: d0c2e9228aff23bdcc62072ef9cebf5ebb0b14fb8638b6df8f7f6d5220c36bd9 - v1.28.6: 2358d98d4970c177a3af0ae1c2398f69922074a961a61cdff6ae4a7f13106dc1 - v1.28.5: 0819c9d0ea66a1e20d74d9a455090e1f67fe07d671866be342ab55532203f4bc - v1.28.4: 835ef8d72f8dec4493b855ddd8e4163f107053496d923c89c216489a45757df6 - v1.28.3: b252ec9e97abde80fe067eb215a1acb69a8c83022cba897fd2c4d387bd45f5ca - v1.28.2: 6576aa70413ff00c593a07b549b8b9d9e5ef73c42bb39ab4af475e0fdb540613 - v1.28.1: eaa05dab1bffb8593d8e5caa612530ee5c914ee2be73429b7ce36c3becad893f - v1.28.0: 372c4e7bbe98c7067c4b7820c4a440c931ad77f7cb83d3237b439ca3c14d3d37 - arm64: - v1.30.4: 1d8b4e6443c7df8e92a065d88d146142a202fea5ec694135b83d9668529ea3b1 - v1.30.3: c6f9568f930b16101089f1036677bb15a3185e9ed9b8dbce2f518fb5a52b6787 - v1.30.2: 56becf07105fbacd2b70f87f3f696cfbed226cb48d6d89ed7f65ba4acae3f2f8 - v1.30.1: d90446719b815e3abfe7b2c46ddf8b3fda17599f03ab370d6e47b1580c0e869e - v1.30.0: 669af0cf520757298ea60a8b6eb6b719ba443a9c7d35f36d3fb2fd7513e8c7d2 - v1.29.7: 7b6649aaa298be728c5fb7ccb65f98738a4e8bda0741afbd5a9ed9e488c0e725 - v1.29.6: 21816488cf3af4cf2b956ee58f7afc5b4964c29488f63756f5ddcf09b0df5be9 - v1.29.5: 9ee9168def12ac6a6c0c6430e0f73175e756ed262db6040f8aa2121ad2c1f62e - v1.29.4: 61537408eedcad064d7334384aed508a8aa1ea786311b87b505456a2e0535d36 - v1.29.3: 191a96b27e3c6ae28b330da4c9bfefc9592762670727df4fcf124c9f1d5a466a - v1.29.2: 3507ecb4224cf05ae2151a98d4932253624e7762159936d5347b19fe037655ca - v1.29.1: 96d6dc7b2bdcd344ce58d17631c452225de5bbf59b83fd3c89c33c6298fb5d8b - v1.29.0: 8f7a4bd6bae900a4ddab12bd1399aa652c0d59ea508f39b910e111d248893ff7 - v1.28.12: f7e01dfffebb1d5811c37d558f28eefd80cbfadc0b9783b0b0ebf37c40c5c891 - v1.28.11: 7984a98d52365d190b6f56caa962339a7228b6f432e58ba5f1b1e60dbedac275 - v1.28.10: e659d23d442c2706debe5b96742326c0a1e1d7b5c695a9fe7dfe8ea7402caee8 - v1.28.9: e0341d3973213f8099e7fcbbf6d1d506967bc2b7a4faac3fb3b4340f226e9b2f - v1.28.8: 93d60dd36093b4c719f1f1bafcf59437c17cb2209341c7c94771e7dd9acdab33 - v1.28.7: 13d547495bdea49b223fe06bffb6d2bef96436634847f759107655aa80fc990e - v1.28.6: 0de705659a80c3fef01df43cc0926610fe31482f728b0f992818abd9bdcd2cb9 - v1.28.5: f87fe017ae3ccfd93df03bf17edd4089672528107f230563b8c9966909661ef2 - v1.28.4: edf1e17b41891ec15d59dd3cc62bcd2cdce4b0fd9c2ee058b0967b17534457d7 - v1.28.3: 06511f03e34d8ee350bd55717845e27ebec3116526db7c60092eeb33a475a337 - v1.28.2: ea6d89b677a8d9df331a82139bb90d9968131530b94eab26cee561531eff4c53 - v1.28.1: 46954a604b784a8b0dc16754cfc3fa26aabca9fd4ffd109cd028bfba99d492f6 - v1.28.0: f5484bd9cac66b183c653abed30226b561f537d15346c605cc81d98095f1717c - amd64: - v1.30.4: 2ffd023712bbc1a9390dbd8c0c15201c165a69d394787ef03eda3eccb4b9ac06 - v1.30.3: abd83816bd236b266c3643e6c852b446f068fe260f3296af1a25b550854ec7e5 - v1.30.2: c6e9c45ce3f82c90663e3c30db3b27c167e8b19d83ed4048b61c1013f6a7c66e - v1.30.1: 5b86f0b06e1a5ba6f8f00e2b01e8ed39407729c4990aeda961f83a586f975e8a - v1.30.0: 7c3807c0f5c1b30110a2ff1e55da1d112a6d0096201f1beb81b269f582b5d1c5 - v1.29.7: e3df008ef60ea50286ea93c3c40a020e178a338cea64a185b4e21792d88c75d6 - v1.29.6: 339553c919874ebe3b719e9e1fcd68b55bc8875f9b5a005cf4c028738d54d309 - v1.29.5: 603c8681fc0d8609c851f9cc58bcf55eeb97e2934896e858d0232aa8d1138366 - v1.29.4: 10e343861c3cb0010161e703307ba907add2aeeeaffc6444779ad915f9889c88 - v1.29.3: 89c0435cec75278f84b62b848b8c0d3e15897d6947b6c59a49ddccd93d7312bf - v1.29.2: 7816d067740f47f949be826ac76943167b7b3a38c4f0c18b902fffa8779a5afa - v1.29.1: 69ab3a931e826bf7ac14d38ba7ca637d66a6fcb1ca0e3333a2cafdf15482af9f - v1.29.0: 0e03ab096163f61ab610b33f37f55709d3af8e16e4dcc1eb682882ef80f96fd5 - v1.28.12: e8aee7c9206c00062ced394418a17994b58f279a93a1be1143b08afe1758a3a2 - v1.28.11: 1dba63e1a5c9520fc516c6e817924d927b9b83b8e08254c8fe2a2edb65da7a9c - v1.28.10: 389c17a9700a4b01ebb055e39b8bc0886330497440dde004b5ed90f2a3a028db - v1.28.9: b4693d0b22f509250694b10c7727c42b427d570af04f2065fe23a55d6c0051f1 - v1.28.8: e02aad5c0bac52c970700b814645b62c4f18b634144398ac344875dbaf1072f8 - v1.28.7: aff42d3167685e4d8e86fda0ad9c6ce6ec6c047bc24d608041d54717a18192ba - v1.28.6: c8351fe0611119fd36634dd3f53eb94ec1a2d43ef9e78b92b4846df5cc7aa7e3 - v1.28.5: 2a44c0841b794d85b7819b505da2ff3acd5950bd1bcd956863714acc80653574 - v1.28.4: 893c92053adea6edbbd4e959c871f5c21edce416988f968bec565d115383f7b8 - v1.28.3: 0c680c90892c43e5ce708e918821f92445d1d244f9b3d7513023bcae9a6246d1 - v1.28.2: c922440b043e5de1afa3c1382f8c663a25f055978cbc6e8423493ec157579ec5 - v1.28.1: e7a7d6f9d06fab38b4128785aa80f65c54f6675a0d2abef655259ddd852274e1 - v1.28.0: 4717660fd1466ec72d59000bb1d9f5cdc91fac31d491043ca62b34398e0799ce - ppc64le: - v1.30.4: a913b4b8573d356483d5c7f14d2cecb290b41ab3b58812567b54ce09e763aad9 - v1.30.3: 3f2ba2216e43b833251a570b1218cba61d43ef2734c0a7751d281656066ab30b - v1.30.2: 738bc1bad45df79fc4313d167a68ed5a1cf747f1f94e4434f0733e3126989f2e - v1.30.1: ef01ae21e91600469db3df01172144fac6c61083e7d3282bef72ce732d76d0d8 - v1.30.0: f8a9eac6e12bc8ab7debe6c197d6536f5b3a9f199e8837afd8e4405291351811 - v1.29.7: fd2bb7de3d46a375c63499f8235dc22901b563a9554f315f7606e0bac78fff94 - v1.29.6: cc145dc1f27f56c81aa2c96c97370e1341b41fbb4fc64cfde4ef4956230fc0e9 - v1.29.5: 1d2635f6bd0218c53037c113171479e15e51b60823f7f1b93afb48ae1d9e5b09 - v1.29.4: 10a1a7e4423483a386ab1ab9237cda1e9d24423c2cf23b7fa514f533aa23ce87 - v1.29.3: 84292286ed2941e52a9df9ccaaf30c3bfebe02a096b67e553d8b643295f231f0 - v1.29.2: 382552d15a1aa7ec5a316b2a912e7fbdaaff2f3c714cd38b2b0c6a48b670fed8 - v1.29.1: b7780124ccfe9640f3a37d242d31e8dbb252bcd379bd0d7bf3776d15baf15ca3 - v1.29.0: ea926d8cf25e2ce982ff5c375da32b51ccbd122b721b1bc4a32f52a9a0d073ab - v1.28.12: ed8255ef27836a88982651bff592e98c623677c926b2a9bc08443319c6678257 - v1.28.11: 63fa54ab9b4fc7b61415a8093bd48db9ce609b78f75c09b03b3b82a3a0c3105f - v1.28.10: aea8f54280e56dd58822fa4ae835ce6c6586727b32fb7bc915c2bee5038ccba9 - v1.28.9: 6c5f40b6467b67fe2cc1540c7e7cb15ba6ad092361395aa7989c2c26e3de0697 - v1.28.8: c9c21c1db306ec34bdc0f8179d1a1e20f8bcdd6d42fccf84267a5686e3218ad1 - v1.28.7: 1394cc047551bbecffee7f1c28cccd0f3c9839a72344854362a08e98d6513c18 - v1.28.6: 60fdb4386b5499dd6a6e3a369f35eef63c99647f7a0436fdbeb4db8c052d14f6 - v1.28.5: 4448a9f95421cbe69726aa4d2967d706bc43466b9c656c7425b55431b1c20dd4 - v1.28.4: 816ca2cef39c0d1ac8ad60c05ae6f6ea5c4a0ca33748240bd1f019381244ca23 - v1.28.3: 2b7331a91f558a748167672c18458aa205d4d6d2794654dfd308942e9a376ca4 - v1.28.2: 87cca30846fec99a4fbea122b21e938717b309631bd2220de52049fce30d2e81 - v1.28.1: 81b45c27abbdf2be6c5203dfccfd76ded1ac273f9f7672e6dcdf3440aa191324 - v1.28.0: 7a9dcb4c75b33b9dac497c1a756b1f12c7c63f86fc0f321452360fbe1a79ce0f -kubeadm_checksums: - arm: - v1.30.4: 0 - v1.30.3: 0 - v1.30.2: 0 - v1.30.1: 0 - v1.30.0: 0 - v1.29.6: 0 - v1.29.7: 0 - v1.29.5: 0 - v1.29.4: 0 - v1.29.3: 0 - v1.29.2: 0 - v1.29.1: 0 - v1.29.0: 0 - v1.28.12: 0 - v1.28.11: 0 - v1.28.10: 0 - v1.28.9: 0 - v1.28.8: 0 - v1.28.7: 0 - v1.28.6: 0 - v1.28.5: 0 - v1.28.4: 0 - v1.28.3: 0 - v1.28.2: 0 - v1.28.1: 0 - v1.28.0: 0 - arm64: - v1.30.4: 609afad8590afb39b500cc5175c64b17690f7bf0b0eebcf1d347656d262e5c8c - v1.30.3: 6590f2447c87346aac29e2ab42fe4f29873f9bf154ee878f00da4c81bfdb8ea2 - v1.30.2: 7268762b7afd44bf07619985dd52c376b63e47d73b8f9a3b08cc49624a8fbd55 - v1.30.1: bda423cb4b9d056f99a2ef116bdf227fadbc1c3309fa3d76da571427a7f41478 - v1.30.0: c36afd28921303e6db8e58274de16c60a80a1e75030fc3c4e9c4ed6249b6b696 - v1.29.7: d0ad904dc3823821c3920499fc151fc83fb6cb9e1c920e39173f96720ad0e053 - v1.29.6: 3ba6879ef491cdd8433647020d345d86c0ea8e77f726375bc4b5495888bbf778 - v1.29.5: d4db8c514f2764edc039462c218dbcd316577f76f21b209b76e9a4b1f08e3100 - v1.29.4: 438287a91e08cbefecab79be8ac893a935c3dbf6e87bea895fb99f2bc38cf06e - v1.29.3: ce2e4c230f954e59ae77e34c4ff2ae08cad3970505ae1e21b6337e6d83b21682 - v1.29.2: e05720feb9d2d67eff25b0156a5c22e2de37be2ffab4e1f4d31e8c526fafd0e1 - v1.29.1: 3bff8c50c104c45e416cce9991706c6ac46365f0defbcd54f8cf4ace0fa68dcf - v1.29.0: bbddee2d46d2e1643ae3623698b45b13aa2e858616d61c642f2f49e5bb14c980 - v1.28.12: e0d94607a036323e45a6866127bc7a374543e27f45f8fc0bf948a2452eab667f - v1.28.11: 15a021fdecf08989d6b64af873d89c61750d3a0564bee58c248eafe5cc4df433 - v1.28.10: f6809d72ed1bf6fde460e48e5c714c3bc92f680e328defa9bd592a796347b644 - v1.28.9: cd6aefad8144a9771fd470529ff14be2675df7b561f7c56dee3fed4f81332dc4 - v1.28.8: e0f47adc69ef84e2f6c42cc341b8a790904a929ad10ed1c23c2e822ec804e247 - v1.28.7: f556e49494737f97a15bf15bb4b27d45f8747b477302cdfd22dd61816bc02203 - v1.28.6: 4298cad464e92eec19cdf3e6a607a82a1d626ae70fedba7956175152ab983457 - v1.28.5: 22bb6b3377204e93d008f33ac4924d77adca1478f1ae3b515c03476ba54f1adc - v1.28.4: a4422780020954436b8e76ab1c59b68c5581a54432dd3e566c4709bb40c8d4f9 - v1.28.3: dcb37d78ccdfe9d8dd6f100e188ddc6e3f5570d0c49db68470073683b453a1e7 - v1.28.2: 010789a94cf512d918ec4a3ef8ec734dea0061d89a8293059ef9101ca1bf6bff - v1.28.1: 7d2f68917470a5d66bd2a7d62897f59cb4afaeffb2f26c028afa119acd8c3fc8 - v1.28.0: b9b473d2d9136559b19eb465006af77df45c09862cd7ce6673a33aae517ff5ab - amd64: - v1.30.4: 6c6053fb8b31030ef7fffe146eb29489f7bf53d7a5ca10e0b10c907bf4b7e281 - v1.30.3: bb78c2a27027278ee644d523f583ed7fdba48b4fbf31e3cfb0e309b6457dda69 - v1.30.2: 672b0cae2accce5eac10a1fe4ea6b166e5b518c79ccf71a2fbe7b53c2ca74062 - v1.30.1: 651faa3bbbfb368ed00460e4d11732614310b690b767c51810a7b638cc0961a2 - v1.30.0: 29f4232c50e6524abba3443ff3b9948d386964d79eb8dfefb409e1f8a8434c14 - v1.29.7: 7699c6f06fbc8e813766b8237de69a095ad820fe484856ffd921a7894b5af605 - v1.29.6: 8f1e04079e614dd549e36be8114ee7022517d646ea715b5778e7c6ab353eb354 - v1.29.5: e424dcdbe661314b6ca1fcc94726eb554bc3f4392b060b9626f9df8d7d44d42c - v1.29.4: ea20ab064f716ab7f69a36d72df340257b31c9721ea86e1cf9d70b35999ddeea - v1.29.3: 6abaa1208bf40b6d1f49e518bd68c8ae4a1be0c5b7d3e45d87979999ab070d8b - v1.29.2: 2d4e4fa8685bcbfb661cb41050cd4756f50a7aa147f68492d51a99f9cdfd69ac - v1.29.1: d4d81d9020b550c896376fb9e0586a9f15a332175890d061619b52b3e9bc6cbd - v1.29.0: 629d4630657caace9c819fd3797f4a70c397fbd41a2a7e464a0507dad675d52c - v1.28.12: 3ffcf5100c6bca3dd0a6c317c744dd97fe497c7c4aefe468321171f940d34971 - v1.28.11: 1f2c7c69736698aa13a59c6705ac26b7b6752d9651330605369357c1ac99c7c6 - v1.28.10: 1a344d34755c5f005120308f09a730e7564c8f857de6606b6bc5f18a69606e5a - v1.28.9: a4d8acf0a74cb1d07d96a1a34148f54c6420874221af16d8ec902d9bffc7ef89 - v1.28.8: c11946cbfd962e1197062534514226cfd70230349e6343ff3ecebfca5476ee64 - v1.28.7: 8aa005bdf6af43e47fc818b26f4cb9f361aae8ec4390519e8d4033be65fbef2b - v1.28.6: bda3eda8d51e8746a42b535b7eab7df52b091a796227c3212dc30909a8f1b431 - v1.28.5: 2b54078c5ea9e85b27f162f508e0bf834a2753e52a57e896812ec3dca92fe9cd - v1.28.4: b4d2531b7cddf782f59555436bc098485b5fa6c05afccdeecf0d62d21d84f5bd - v1.28.3: ce3848b1dfa562e0fa2f911a3d8e3bb07ba040eea76654d68e213315c8846ac0 - v1.28.2: 6a4808230661c69431143db2e200ea2d021c7f1b1085e6353583075471310d00 - v1.28.1: 6134dbc92dcb83c3bae1a8030f7bb391419b5d13ea94badd3a79b7ece75b2736 - v1.28.0: 12ea68bfef0377ccedc1a7c98a05ea76907decbcf1e1ec858a60a7b9b73211bb - ppc64le: - v1.30.4: df0a42a57e69f3080871736d0953f1f287f63def0ed514324aca2469463efd7a - v1.30.3: 76a58a7389365295fb4ea1163c2644c3700f066a8e8cb1b7897ad83576e43ce2 - v1.30.2: 8aee71554003411470a5933cdff7896736ae1182055c0de6bb3782d0a7581c71 - v1.30.1: dc529fae8227422a23a8d4f70e28161fa207a4da7cb24d340aae0592dd729ea5 - v1.30.0: a77badcaff292862df8324e17f74ab7ce3c6ea9f390647878f1838a3a832f413 - v1.29.7: 8570e534f3712511284b2e0122d8fe46e36050a0c009df852b69b2de931c53b7 - v1.29.6: 577cdd37fc929be0ffcdc2aa5337bba36a409e00f538da0dcca611a4161be461 - v1.29.5: 05c92f52d75268f0aaff5056e0d6b3e03002b2d17432360750100ada9b2c381b - v1.29.4: ec47a2dbe1969b9513b0313b5b07b72a870e5da54864d9c8391ec5e857404659 - v1.29.3: c0e1f6e9451f28c7b8abf7d3a081fe97578ada69908135e3390f5783511ff7f8 - v1.29.2: a0f8ffa8cbfa4bb061ff028df2f6dbb31a9527c561d8c0186d679559f9f347b4 - v1.29.1: 3ec6d90c05dd8e4c6bb1f42fd2fe0f091d85317efaf47d9baebd9af506b3878b - v1.29.0: 4c414a463ed4277e9062c797d1c0435aa7aec2fd1688c5d34e3161c898113cb5 - v1.28.12: 36f6419cacb46b44d762c12a9580f1e16c6af266e4269e8cedb4d8e5fe355da1 - v1.28.11: 23d8f0c63acea7c9ae4082930f4fa82fc9659ea112f408a439a09a40c5d59223 - v1.28.10: 39a5a27b70ea9eb7e86a37c8862691d875f462a6d52a02355873ffca4595e045 - v1.28.9: 616d06ae90a8e3eb79d99a06b1a7dd304da02e7a2d8c58c1c0e501bdd3982a00 - v1.28.8: 5a42d2c06f553c4284ce6f3f48432389cd63f768f2a032b78ca6ee4c925e9b11 - v1.28.7: 60aec330562326fe1ac4a26fe16053c976467fdbc5811c37a5b4a5c13379cac8 - v1.28.6: 71fc8af0f80599a991ece0c31b21ca85f3ce49322941a305048d9287c249446c - v1.28.5: a9bf8b18711639d9d002f63cebc22c8df1627737891c640f2229461d19b8c321 - v1.28.4: 24e4b42b1d0ec68fc291fcc57fa88ec34b9e8ba758e01639873ef2068222af4a - v1.28.3: 0ae62912b057f3228dd7a9fbe2492c4b8c3a661f27a1d46e70b0b6627ccf60fb - v1.28.2: fdc28482a4316c84d61b0997c29c4d4c7b11459af9c654fdee3b4a3031f0fcb7 - v1.28.1: 73e06f2b614ed5665951f7c059e225a7b0b31319c64a3f57e146fbe7a77fe54e - v1.28.0: 146fe9194486e46accd5054fa93939f9608fdbeefefc4bc68e4c40fb4a84ccc9 -etcd_binary_checksums: - arm: - v3.5.12: 0 - v3.5.11: 0 - v3.5.10: 0 - v3.5.9: 0 - v3.5.8: 0 - v3.5.7: 0 - v3.5.6: 0 - arm64: - v3.5.12: 31f30c01918771ece28d6e553e0f33be9483ced989896ecf6bbe1edb07786141 - v3.5.11: 6edf0cddc8fa2d7674129abe2e44d5a37cc3a6e3b500c13c6cbc2ed2ecf08bf4 - v3.5.10: ff74a6018d9b2a1320bff30e5a11b4f2f5c2a3d147df8a8bad53c01b9f800ee1 - v3.5.9: bb201c106a61bbab59e2d9f37f4bdff99d50201f513c66b4578741eab581fb28 - v3.5.8: 3f4441b293a2d0d4d2f8b2cd9504376e15818f7b865ef4b436e8e6f865f895ff - v3.5.7: 1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51 - v3.5.6: 888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87 - amd64: - v3.5.12: f2ff0cb43ce119f55a85012255609b61c64263baea83aa7c8e6846c0938adca5 - v3.5.11: e256885e753dc99001335e099d3c2eb8cf21a865a087ee4d7e3665752ae5929a - v3.5.10: 26e90d024fa2310bc52bb40e7f2132e81640b55f8fc446c00ae07e30af2a44fd - v3.5.9: d59017044eb776597eca480432081c5bb26f318ad292967029af1f62b588b042 - v3.5.8: d4c1b8d90ad53658f12ffc293afc5694b7bc6cb093af609188649a799e1cc8dc - v3.5.7: a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396 - v3.5.6: 4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb - ppc64le: - v3.5.12: ebd8060508d572678d8d1e4f90f87863e3a6cfcba856ceca32379b03251c0597 - v3.5.11: a2e70b291811fa8ccc34cc7d297bf7d31e3af790bc31e54cad034a49e9db2eb7 - v3.5.10: 10cd8e4ecf6718b9712bf2edfac2e4924d7f21dbe58d368e6e10578c85bd8c01 - v3.5.9: 551539ebb344ebdc77f170ea51512a6cda35877ffdcbd8b3316b2495a8b2bd87 - v3.5.8: 20e28302c1424b1a3daf7d817f2662e4c64e395a82765d1696cb53cb6bc37a4e - v3.5.7: e861aa6acd4d326ec01bfa06fffb80d33f3f8c26e0eb8b73e4424578d149bd04 - v3.5.6: e235cb885996b8aac133975e0077eaf0a2f8dc7062ad052fa7395668a365906b -cni_binary_checksums: - arm: - v1.4.0: 6cddc5804fff93b914f3314d62fa03f24d69f59c03940e0bbe85a370371b5bb8 - v1.3.0: 86c4c866a01a8073ad14f6feec74de1fd63669786850c7be47521433f9570902 - v1.2.0: fde5bf2da73995196d248177ee8deeafa8005f33cbe1ab33bd2d75c17ca5a99a - v1.1.1: 84f97baf80f9670a8cd0308dedcc8405d2bbc65166d670b48795e0d1262b4248 - v1.1.0: 91e03a9287dcf8d0249159c90357b0f871ecf7ef0ca5014b2e143f2b30ae9c6d - v1.0.1: d35e3e9fd71687fc7e165f7dc7b1e35654b8012995bbfd937946b0681926d62d - v1.0.0: 910c2ba8b6f50b1081b219d6db04459b555940973249fcf39a792932a91f6d39 - arm64: - v1.4.0: 304d4389d5b732b7a73513d002c4895f731d030682d40653f411e10e39114194 - v1.3.0: de7a666fd6ad83a228086bd55756db62ef335a193d1b143d910b69f079e30598 - v1.2.0: 525e2b62ba92a1b6f3dc9612449a84aa61652e680f7ebf4eff579795fe464b57 - v1.1.1: 16484966a46b4692028ba32d16afd994e079dc2cc63fbc2191d7bfaf5e11f3dd - v1.1.0: 33fc7b8d9d5be2d7f95e69e6a9e2af206879942f1e6b7615c04017dce5067f1a - v1.0.1: 2d4528c45bdd0a8875f849a75082bc4eafe95cb61f9bcc10a6db38a031f67226 - v1.0.0: 736335bc5923a37cfb6cc2305489ce6206bcc565004f525b5f7c3604f092aa3a - amd64: - v1.4.0: c2485ddb3ffc176578ae30ae58137f0b88e50f7c7f2af7d53a569276b2949a33 - v1.3.0: 754a71ed60a4bd08726c3af705a7d55ee3df03122b12e389fdba4bea35d7dd7e - v1.2.0: f3a841324845ca6bf0d4091b4fc7f97e18a623172158b72fc3fdcdb9d42d2d37 - v1.1.1: b275772da4026d2161bf8a8b41ed4786754c8a93ebfb6564006d5da7f23831e5 - v1.1.0: 05d46ac19d01669d424ee57401c0deba101763ac494858064b4ea4ffdcc37c5d - v1.0.1: 5238fbb2767cbf6aae736ad97a7aa29167525dcd405196dfbc064672a730d3cf - v1.0.0: 5894883eebe3e38f4474810d334b00dc5ec59bd01332d1f92ca4eb142a67d2e8 - ppc64le: - v1.4.0: c87a36a75ad1692933e3218cae734ba809ae2190c725a050ac9033fc96d2ed26 - v1.3.0: 8ceff026f4eccf33c261b4153af6911e10784ac169d08c1d86cf6887b9f4e99b - v1.2.0: 4960283b88d53b8c45ff7a938a6b398724005313e0388e0a36bd6d0b2bb5acdc - v1.1.1: 1551259fbfe861d942846bee028d5a85f492393e04bcd6609ac8aaa7a3d71431 - v1.1.0: 98239a57452e93c0a27ba9f87bcbb80c7f982f225246f3fe4f3f5ac9b6b1becb - v1.0.1: f078e33067e6daaef3a3a5010d6440f2464b7973dec3ca0b5d5be22fdcb1fd96 - v1.0.0: 1a055924b1b859c54a97dc14894ecaa9b81d6d949530b9544f0af4173f5a8f2a -calicoctl_binary_checksums: - arm: - v3.28.1: 0 - v3.28.0: 0 - v3.27.3: 0 - v3.27.2: 0 - v3.27.1: 0 - v3.27.0: 0 - v3.26.4: 0 - v3.26.3: 0 - v3.26.2: 0 - v3.26.1: 0 - v3.26.0: 0 - v3.25.2: 0 - v3.25.1: 0 - v3.25.0: 0 - v3.24.6: 0 - v3.24.5: 0 - v3.24.4: 0 - v3.24.3: 0 - v3.24.2: 0 - v3.24.1: 0 - v3.24.0: 0 - v3.23.5: 0 - v3.23.4: 0 - arm64: - v3.28.1: c062d13534498a427c793a4a9190be4df3cf796a3feb29e4a501e1d6f48daa7c - v3.28.0: c4ca8563d2a920729116a3a30171c481580c8c447938ce974ce14d7ce25a31bf - v3.27.3: 1fc5f58a18d8b1c487b4663fc5cbe23b45bd9d31617debd309f6dfac7c11a8ef - v3.27.2: 0fd1f65a511338cf9940835987d420c94ab95b5386288ba9673b736a4d347463 - v3.27.1: 0 - v3.27.0: b4b8c71f9658165e45336b9b5e4fad865529feeffe4294247eb5b4c4310dcaf9 - v3.26.4: d647d9443ce89df62da6619643375a4f577f5a7fa4e1162416403df521826c2d - v3.26.3: c50272a39658a3b358b33c03fe10d1dde894764413279fecc72d40b95535b398 - v3.26.2: 44de9118f481a1125e2d50cdfbb55073e744dd8e71d2be45eeb2757302910c67 - v3.26.1: bba2fbdd6d2998bca144ae12c2675d65c4fbf51c0944d69b1b2f20e08cd14c22 - v3.26.0: b88c4fd34293fa95d4291b7631502f6b9ad38b5f5a3889bb8012f36f001ff170 - v3.25.2: 1cf28599dc1d52ef7c888731f508662a187129ff7bb3294f58319d79c517085c - v3.25.1: 83084be5de90a94bfd7a10da5758acbf200ddd68fa24ee4e7e1dedc8935aa41d - v3.25.0: 6eda153187ab76821903cf6bb69fe11b016529c3344e2dd1a0f7f3cb3069ded0 - v3.24.6: 98eaeb3d75c7ebb41012641e393a442a509f00572981abcc758668ac0806e1e7 - v3.24.5: 2d56b768ed346129b0249261db27d97458cfb35f98bd028a0c817a23180ab2d2 - v3.24.4: 90ffaf6aab30d5e4c7227cf20a68c7254ec9d871f2e7a4a98ba86a855ee61040 - v3.24.3: dfd74167dd55677a54ac73fd1e3f9391d62cf7f4da210b267d437d4a9b7d4561 - v3.24.2: 6fe53f3ba1c7291e2b1cd15ccb72c393297a668cec46f4aa7137499f68fb37e6 - v3.24.1: b7b1a023ddb81ec32f385f4b90f9a3f415d7fce6242e1ae8ebe5c77b2015209c - v3.24.0: db306755fc9c6a746516eec33337bc102b0d546f6b9fc671795b47d1a878f05d - v3.23.5: 0941ad0deeb03d8fda96340948cdbc15d14062086438150cf3ec5ee2767b22c3 - v3.23.4: c54b7d122d9315bbab1a88707b7168a0934a80c4f2a94c9e871bcc8a8cf11c11 - amd64: - v3.28.1: 22ec5727c38dbe19001792b4ca64ac760a6e2985d5c1a231d919dbebe5bca171 - v3.28.0: 4ea270699e67ca29e5533ddb0a68d370cb0005475796c7e841f83047da6297b6 - v3.27.3: e22b8bb41684f8ffb5143b50bf3b2ab76985604d774d397cfb6fb11d8a19f326 - v3.27.2: 692f69dc656e41cd35e23e24f56c98c4aeeb723fed129985b46f71e6eb5e1594 - v3.27.1: 0 - v3.27.0: 46e79ae146b3dd90998f56511cf5d6db64deb97cb784235caf1f99e0672d66e4 - v3.26.4: 9960357ef6d61eda7abf80bd397544c1952f89d61e5eaf9f6540dae379a3ef61 - v3.26.3: 82bd7d12b0f6973f9593fb62f5410ad6a81ff6b79e92f1afd3e664202e8387cf - v3.26.2: eba9bc34f44801a513c48f730a409dc1ece0ebfd9c1acc21fd3adf0eff93ecdc - v3.26.1: c8f61c1c8e2504410adaff4a7255c65785fe7805eebfd63340ccd3c472aa42cf - v3.26.0: 19ce069f121f9e245f785a7517521e20fe3294ce1add9d1b2bbcbb0a9b9de24e - v3.25.2: b6f6017b1c9520d8eaea101442d82020123d1efc622964b20d97d3e08e198eed - v3.25.1: 13565e5304209ffaa93df3ba722e6f623b66c76057ca8ff5c5864fa13176fe48 - v3.25.0: 5a464075ccbaa8715882de6b32fe82b41488e904fa66b19c48ee6388cf48b1b8 - v3.24.6: 52e8231d14f626c9b3273659697d95559c72e1b081e713b86eaa7f6910bda384 - v3.24.5: 01e6c8a2371050f9edd0ade9dcde89da054e84d8e96bd4ba8cf82806c8d3e8e7 - v3.24.4: 6d6448537d9abd827c01f289303cf66729578b0bd952c043228568af46000e49 - v3.24.3: 22d7ba5547aff1b4202ddd55952c1e5b6e45e416cd79e1721438aab54a23324a - v3.24.2: 185be69fffcaf46fea8328fcc1b73167021fe16548459148853d084ba8a4aac8 - v3.24.1: 10a36ebc7a4cf355b28e061f5a5f4b261daff4773a51ac73ca1071e7551a934a - v3.24.0: 0da282a6a7870fe25742799a921730343c57a1609c5e255e1bb06b5e85011ee2 - v3.23.5: 4c777881709ddaabcf4b56dcbe683125d7ed5743c036fee9273c5295e522082f - v3.23.4: 1ea0d3b6543645612e8239978878b6adefdb7619a16ecbdb8e6dc2687538f689 - ppc64le: - v3.28.1: 985caad36fed7b883a2cd4cf91e556974bcca95fe4e6b7ff4cb64d8d8fbe9223 - v3.28.0: 0789cb0d1478ec3f0a44db265b19042be9dfc18bc1776343c7ea8d246561d12b - v3.27.3: 5f2ac510c0ec31ec4c02ff2660f2502b68b655616d5b766a51bd99d2e3604fbc - v3.27.2: f918bb88de1d01de3d143e1e75d0ee1256f247c5cbabec7d665aaf8d1fd3cc6c - v3.27.1: 0 - v3.27.0: 3de46d8bc30c6f9d9387d484ed62a5655c1f204b1b831b5a90f0a0d1c1ffd752 - v3.26.4: 41cfa77cc27cfe89a046ddb033cf71a46512f4b81251e28c69fca2cee13617ff - v3.26.3: 30a32acbe71894a9783e350ed44294e739b3322f157b2c224ad3c058473e5701 - v3.26.2: c4d42a85afb67020e9cf9dcafe184af6ad60c5609d60001b9505b1a83959b246 - v3.26.1: 7f8baf18f4d7954b6f16b1ddcdadbc818cae2fe1f72137464ccc7b8e6fef03a0 - v3.26.0: b82b931e3aa53248d87b24f00969abfe5ea4518c56a85b5894187c7b47dc452e - v3.25.2: a5e19931ce50953a36387c67b596e56c4b4fc7903893f1ad25248177027ad0dd - v3.25.1: 43f7a19c3f81a658349d727283f201ce5a560dc9a9f7e56d70961755f4196135 - v3.25.0: 15545aa42dfafb12b68070253e649dfbfdb4b495935e4717d2f04c46500d1a9e - v3.24.6: 1d2e2d8ec1524c5fd9f9796bb6ec53e3351d1833c11eb312ca39b549dbccf188 - v3.24.5: 4c40d1703a31eb1d1786287fbf295d614eb9594a4748e505a03a2fbb6eda85b4 - v3.24.4: 2731382823179b49f1e9af7cddca7da191a54d5163a15b19b5ae75ed27dd30f9 - v3.24.3: 2811f71a9a31f8b2965109dc2bbbae24eb5425b4366a6dea8bed1fdb2abe5b60 - v3.24.2: 06c356c1ff741c7d2b49daade10e1bde49ef7db962adfea30dbc4bb314ac8abb - v3.24.1: f2b24bb1cb33795ceba2988ea89e78f25e8fb6283ea22a59a676e37a68a5771e - v3.24.0: cf63f4820e792c101940af3ed6422e1b8769ffcbafd0c3672f2e86675733b053 - v3.23.5: 1b352e73515cbe5746f9b9d7633d8317bd48f713b9b731837f7d79089463321c - v3.23.4: cdd6eace3dc2676b7eed79c665cb0b3dbdd9dcb3bf5b09d7ae20f4f015f75f9b -ciliumcli_binary_checksums: - arm: - v0.16.0: 0 - v0.15.23: 0 - v0.15.22: 0 - v0.15.21: 0 - v0.15.20: 0 - v0.15.19: 0 - v0.15.18: 0 - v0.15.17: 0 - v0.15.16: 0 - v0.15.15: 0 - arm64: - v0.16.0: fe16bcd447fc6fe764ca75712f5832d7504845e9f782684ff09c9f52548237fe - v0.15.23: 9aa37d99a15e72bbcb555d7ed5b88c2ae3a7e6fbc478f9ee402a835ba6b41175 - v0.15.22: 23caf44dade82b5a986e9799db333724845750bebe32e571a356ab9116406f6d - v0.15.21: 346bf2d0d60e11e02c676bcd7cb379cbedd88830188dbf811ad7099f5907da9d - v0.15.20: 4b05fb1661b699edd89f37124d5cd0aa4f5dcfc197cef6a0bc7a6faa3dc119d4 - v0.15.19: a32521b2add0203c1945f71c6d8a50739946b4f7e35c2636529a5063959072d4 - v0.15.18: fa1aecaf1c69663bdece17608c6e85f0a5a2c8ee8fe2cbbadf25cbe887b7ae15 - v0.15.17: 4df6f634512a0e426258fbb83d43c0defabe9d91c81480c040af08fa05b4a989 - v0.15.16: 86ed6a2e796c39dd00072e7c141fc35b68d63392d1ac5e183a7ce9d7263e23a0 - v0.15.15: 5c1693ea163b094a92ebc6997b6e678cc8c24a52040c22433b58b419de74b28f - amd64: - v0.16.0: da98675f961833d4ffd68b1046d907b228a7d394ded2abd70a50b20eaca171c4 - v0.15.23: cda3f1c40ae2191a250a7cea9e2c3987eaa81cb657dda54cd8ce25f856c384da - v0.15.22: c9bdf99362c16bb63ea44a214e39319d8ac1d196345792caae9665f36fe274a3 - v0.15.21: 89190bb3fdcde892d7a8d3a9718e5ffacd312d2535eee54d93ccc81c2d430cb7 - v0.15.20: a1a09f3f0176e118b1b00be4fcd7f9f32f27c9587c64b5579d2747d751e72e23 - v0.15.19: 9632fa506d7d0e0298dc5b80b9e05239ceb01d60b124dde2132417a96ba4d07b - v0.15.18: b10359784d4c194d43bbd1de5d7000f9697e451049008ade5a0754e3c4f7958e - v0.15.17: ed8edbce96ac7921ee75b2fbe42409fbe381e2f8f896c10d13f864cc52e07a43 - v0.15.16: f30095e1a0b926d2114b7a419141bea76e950b643182e97e666950ca05a205d9 - v0.15.15: 492279c1f960c79747290a5d1e1b21084a04a93f9e13ab4ae7df4c76fe808aff - ppc64le: - v0.16.0: 0 - v0.15.23: 0 - v0.15.22: 0 - v0.15.21: 0 - v0.15.20: 0 - v0.15.19: 0 - v0.15.18: 0 - v0.15.17: 0 - v0.15.16: 0 - v0.15.15: 0 -calico_crds_archive_checksums: - v3.28.1: c56f1530e7ded9d5b4afb9d83a7a24da6d2959ef7ad38521813f1c2bf138182d - v3.28.0: ee721337db0cd847e91aae1cdfd420596896ebcb865575fd913c2f12ac2cdb76 - v3.27.3: d11a32919bff389f642af5df8180ad3cec586030decd35adb2a7d4a8aa3b298e - v3.27.2: 8154bb4aad887f2a5500b505fe203a918f72c4e602b04c688c4b94f76a26e925 - v3.27.1: 76abb0db222af279e3514cfae02be9259097b565bbb2ffcb776ca00566480edb - v3.27.0: 2a4b5132035dfd6ac4abc8d545f33de139350eca523e0c5cfe4ac32e43fcb2f1 - v3.26.4: 481e52de684c049f3f7f7bac78f0f6f4ae424d643451adc9e3d3fa9d03fb6d57 - v3.26.3: b51817e7ae5189b0737ccc901b7b5950a4f84b6029eebfdcc3e3b851bd410d03 - v3.26.2: 8c15b29db525c4cab7bea304357c942a0d55483c03d9c2a0ed3303f66b8f9ff8 - v3.26.1: 6d0afbbd4bdfe4deb18d0ac30adb7165eb08b0114ec5a00d016f37a8caf88849 - v3.26.0: a263e507e79c0a131fdc2a49422d3bdf0456ea5786eb44ace2659aba879b5c7c - v3.25.2: 6a6e95a51a8ebf65d41d671f20854319cca1f26cd87fbcfc30d1382a06ecfee0 - v3.25.1: 4d6b6653499f24f80a85a0a7dac28d9571cabfa25356b08f3b438fd97e322e2d - v3.25.0: 117b4493ad933f24ea6fb82eabfad300da2dd926995bb8c55336595d38c72881 - v3.24.6: 71644374ae7f50bc17cd79544b07e59a3967d1d43b289ae62d750ce9167312e9 - v3.24.5: 10320b45ebcf4335703d692adacc96cdd3a27de62b4599238604bd7b0bedccc3 - v3.24.4: 7f8e54f50388784b5c17ba20ebfb0b65c6a87291771fe8be300646906aa1558d - v3.24.3: dbe3a48d602a3ac9073185a9e12e2452f4520b3e8c01f1af8603ef7af5e44fe9 - v3.24.2: eb0a57e6eb37c4658aa51ecfc078d1dfacb89da23a10b67fed8ea0e4e9c66eea - v3.24.1: 62c30e126c1595adc851f3df0a69926cc6bf97a7d0d38293f23d2232c6411a31 - v3.24.0: 3c6694779b916fa364592a8e19d45f509c67e7dec64fb4cf09c379e170de7720 - v3.23.5: aca591282d9e10a180a2afb05da6ca8db4dd02b886b4788f4962cf5b37ba1bda - v3.23.4: c8b6b033755416756b2b5ef248332b7c5b660618327cb7f83a80fb949fdc601a -krew_archive_checksums: - darwin: - arm: - v0.4.4: 0 - v0.4.3: 0 - arm64: - v0.4.4: e6ac776140b228d6bdfda11247baf4e9b11068f42005d0975fc260c629954464 - v0.4.3: 22f29ce3c3c9c030e2eaf3939d2b00f0187dfdbbfaee37fba8ffaadc46e51372 - amd64: - v0.4.4: 5f4d2f34868a87cf1188212cf7cb598e76a32f389054089aad1fa46e6daf1e1b - v0.4.3: 6f6a774f03ad4190a709d7d4dcbb4af956ca0eb308cb0d0a44abc90777b0b21a - ppc64le: - v0.4.4: 0 - v0.4.3: 0 - linux: - arm: - v0.4.4: 4f3d550227e014f3ba7c72031108ffda0654cb755f70eb96be413a5102d23333 - v0.4.3: 68eb9e9f5bba29c7c19fb52bfc43a31300f92282a4e81f0c51ad26ed2c73eb03 - arm64: - v0.4.4: f8f0cdbf698ed3e8cb46e7bd213754701341a10e11ccb69c90d4863e0cf5a16a - v0.4.3: 0994923848882ad0d4825d5af1dc227687a10a02688f785709b03549dd34d71d - amd64: - v0.4.4: e471396b0ed4f2be092b4854cc030dfcbb12b86197972e7bef0cb89ad9c72477 - v0.4.3: 5df32eaa0e888a2566439c4ccb2ef3a3e6e89522f2f2126030171e2585585e4f - ppc64le: - v0.4.4: 0 - v0.4.3: 0 - windows: - arm: - v0.4.4: 0 - v0.4.3: 0 - arm64: - v0.4.4: 0 - v0.4.3: 0 - amd64: - v0.4.4: da0dfeb2a598f11fb9ce871ee7f3b1a69beb371a45f531ee65a71b2201511d28 - v0.4.3: d1343a366a867e9de60b23cc3d8ee935ee185af25ff8f717a5e696ba3cae7c85 - ppc64le: - v0.4.4: 0 - v0.4.3: 0 -helm_archive_checksums: - arm: - v3.15.4: aa3fb3014d147e5dcf8bfe4f6d5fe8677029ed720d4a4bcc64e54cb745a72206 - v3.15.3: 77a9c9699c836dd34fca3d9e783f9e70e0ddbe1a4b44aa13fac82f6193da452f - v3.15.2: 2b28fda1d8c6f087011bc7ec820051a13409dadce8385529f306476632e24e85 - v3.15.1: fa7a8b472c8f311ac618a231218511efeafad306781d11ad68976e0461074b0e - v3.15.0: 614d53ab1192667facce7e8d4e884ff067e5684199a7e5223e8808abc43e927f - v3.14.4: 962297c944c06e1f275111a6e3d80e37c9e9e8fed967d4abec8efcf7fc9fb260 - v3.14.3: d4ff88f02d6731ec5dbde86a67bf391e673d0d9e87901727fbf62372aff106ec - v3.14.2: b70fb6fa2cdf0a5c782320c9d7e7b155fcaec260169218c98316bb3cf0d431d9 - v3.14.1: f50c00c262b74435530e677bcec07637aaeda1ed92ef809b49581a4e6182cbbe - v3.14.0: cf38dfdead7266ae56662743bda0c78655814f0adeca382d1b07a812bb1a599a - arm64: - v3.15.4: fa419ecb139442e8a594c242343fafb7a46af3af34041c4eac1efcc49d74e626 - v3.15.3: bd57697305ba46fef3299b50168a34faa777dd2cf5b43b50df92cca7ed118cce - v3.15.2: adcf07b08484b52508e5cbc8b5f4b0b0db50342f7bc487ecd88b8948b680e6a7 - v3.15.1: b4c5519b18f01dd2441f5e09497913dc1da1a1eec209033ae792a8d45b9e0e86 - v3.15.0: c3b0281fca4c030548211dd6e9b032ee0a9fc53eab614f6acbaff631682ce808 - v3.14.4: 113ccc53b7c57c2aba0cd0aa560b5500841b18b5210d78641acfddc53dac8ab2 - v3.14.3: 85e1573e76fa60af14ba7e9ec75db2129b6884203be866893fa0b3f7e41ccd5e - v3.14.2: c65d6a9557bb359abc2c0d26670de850b52327dc3976ad6f9e14c298ea3e1b61 - v3.14.1: f865b8ad4228fd0990bbc5b50615eb6cb9eb31c9a9ca7238401ed897bbbe9033 - v3.14.0: b29e61674731b15f6ad3d1a3118a99d3cc2ab25a911aad1b8ac8c72d5a9d2952 - amd64: - v3.15.4: 11400fecfc07fd6f034863e4e0c4c4445594673fd2a129e701fe41f31170cfa9 - v3.15.3: ad871aecb0c9fd96aa6702f6b79e87556c8998c2e714a4959bf71ee31282ac9c - v3.15.2: 2694b91c3e501cff57caf650e639604a274645f61af2ea4d601677b746b44fe2 - v3.15.1: 7b20e7791c04ea71e7fe0cbe11f1a8be4a55a692898b57d9db28f3b0c1d52f11 - v3.15.0: a74747ac40777b86d3ff6f1be201504bba65ca46cd68b5fe25d3c394d0dcf745 - v3.14.4: a5844ef2c38ef6ddf3b5a8f7d91e7e0e8ebc39a38bb3fc8013d629c1ef29c259 - v3.14.3: 3c90f24e180f8c207b8a18e5ec82cb0fa49858a7a0a86e4ed52a98398681e00b - v3.14.2: 0885a501d586c1e949e9b113bf3fb3290b0bbf74db9444a1d8c2723a143006a5 - v3.14.1: 75496ea824f92305ff7d28af37f4af57536bf5138399c824dff997b9d239dd42 - v3.14.0: f43e1c3387de24547506ab05d24e5309c0ce0b228c23bd8aa64e9ec4b8206651 - ppc64le: - v3.15.4: e4efce93723f52dd858e9046ea836c9c75f346facce1b87b8cf78c817b97e6ac - v3.15.3: fac86a8a0515e1f4593d6288426c99f2b3edac946b7f118fcfe03e4a09523f25 - v3.15.2: 9d95528fb797f6429f7f9b6dee0cf87bf8c71f6470e1db4a51e844c169c285a3 - v3.15.1: 0bfe2ff8b29c1f26b0484261c0fe0d041188b2e1aa5da8e461e44083bbf655a3 - v3.15.0: bcec19cdad95cae99edce046ccd8090f275e63381ccb6accb4304819fc26e004 - v3.14.4: d0d625b43f6650ad376428520b2238baa2400bfedb43b2e0f24ad7247f0f59b5 - v3.14.3: aab121ca470e2a502cda849a9b3e92eeb9a32e213b0f0a79a95a04e375d26ce7 - v3.14.2: f3bc8582ff151e619cd285d9cdf9fef1c5733ee5522d8bed2ef680ef07f87223 - v3.14.1: 4d853ab8fe3462287c7272fbadd5f73531ecdd6fa0db37d31630e41ae1ae21de - v3.14.0: f1f9d3561724863edd4c06d89acb2e2fd8ae0f1b72058ceb891fa1c346ce5dbc -cri_dockerd_archive_checksums: - arm: - 0.3.11: 0 - 0.3.10: 0 - 0.3.9: 0 - 0.3.8: 0 - 0.3.7: 0 - 0.3.6: 0 - 0.3.5: 0 - arm64: - 0.3.11: 877f635a7005b393f7aab24ca4b1cd7bdfb3b967d055e858408240c86e3cab9a - 0.3.10: 24d2d9cdbb4ed4bda4b0838edb52104ac7a4e2212a0ee05b177de0ae5b6a4a9a - 0.3.9: f5051002b4f95b0e8fe7fbd5f8de4493350e010834d2a8b647f2b26c45c6c203 - 0.3.8: 64286af171785f0facb72cf364867600b4db19f43a01db49b8b364f5d04aadae - 0.3.7: 8da54563ee7ddee36b1adf1f96b3b7b97ec2bc0ec23559b89d9af8eae5e62d9e - 0.3.6: 793b8f57cecf734c47bface10387a8e90994c570b516cb755900f21ebd0a663b - 0.3.5: c20014dc5a71e6991a3bd7e1667c744e3807b5675b1724b26bb7c70093582cfe - amd64: - 0.3.11: b2475988f3b86d85c7835269121171e35c92454ad5f4cd6252183b0fccd74d63 - 0.3.10: 3e19ef525e02d2d1dfd42e8d661ee45b4bc8a49a6dcafd8baa578bdb3a23aeb6 - 0.3.9: a6d9b4b796e9eff830311a2349d259507302cb3955dd07b78296b91e40e8b433 - 0.3.8: e12ea6df8228b7d0794c930d32117c4e5a3dcf25a56c3facdf7006289ec6383c - 0.3.7: 518c5d5345085f36d311f274208705d7fdb79337a80c256871ce941d5a7d47a1 - 0.3.6: cf271d65abee88c0c0a6d9dacb151913bf37d25d45913a7e04b09efe408eae18 - 0.3.5: 30d47bd89998526d51a8518f9e8ef10baed408ab273879ee0e30350702092938 - ppc64le: - 0.3.11: 0 - 0.3.10: 0 - 0.3.9: 0 - 0.3.8: 0 - 0.3.7: 0 - 0.3.6: 0 - 0.3.5: 0 -runc_checksums: - arm: - v1.1.13: 0 - v1.1.12: 0 - v1.1.11: 0 - v1.1.10: 0 - v1.1.9: 0 - v1.1.8: 0 - arm64: - v1.1.13: 4b93701752f5338ed51592b38e039aef8c1a59856d1225df21eba84c2830743c - v1.1.12: 879f910a05c95c10c64ad8eb7d5e3aa8e4b30e65587b3d68e009a3565aed5bb8 - v1.1.11: 9f1ee53f06b78cc4a115ca6ae4eec10567999539ce828a22c5351edba043ed12 - v1.1.10: 4830afd426bdeacbdf9cb8729524aa2ed51790b8c4b28786995925593708f1c8 - v1.1.9: b43e9f561e85906f469eef5a7b7992fc586f750f44a0e011da4467e7008c33a0 - v1.1.8: 7c22cb618116d1d5216d79e076349f93a672253d564b19928a099c20e4acd658 - amd64: - v1.1.13: bcfc299c1ab255e9d045ffaf2e324c0abaf58f599831a7c2c4a80b33f795de94 - v1.1.12: aadeef400b8f05645768c1476d1023f7875b78f52c7ff1967a6dbce236b8cbd8 - v1.1.11: 77ae134de014613c44d25e6310a57a219a7a91155cd47d069a0f22a2cad5caea - v1.1.10: 81f73a59be3d122ab484d7dfe9ddc81030f595cc59968f61c113a9a38a2c113a - v1.1.9: b9bfdd4cb27cddbb6172a442df165a80bfc0538a676fbca1a6a6c8f4c6933b43 - v1.1.8: 1d05ed79854efc707841dfc7afbf3b86546fc1d0b3a204435ca921c14af8385b - ppc64le: - v1.1.13: 4675d51dc0b08ad8e17d3065f2e4ce47760728945f33d3092385e792357e6519 - v1.1.12: 4069d1d57724126e116ad6dbd84409082d1b0afee1ee960b17558f146a742bb6 - v1.1.11: e3d1da41f97db1bb7e9a8d96c9092747c14ee53bc9f160048828e63f3a2d0896 - v1.1.10: 94a091c06c363e4af7be398dc31fa6e02576d5ecda6de1cbf3a08fe8662bf678 - v1.1.9: 065cf4f84b5acc0acdb017af2955743dfb5f5e1f49a493eea3e8206f33bf6fe6 - v1.1.8: a816cd654e804249c4f757cc6bf2aa2c128e4b8e6a993067d44c63c891c081ab -crun_checksums: - arm: - 1.14.4: 0 - 1.14.3: 0 - 1.14.2: 0 - 1.14.1: 0 - 1.11.2: 0 - 1.11.1: 0 - 1.9.2: 0 - arm64: - 1.14.4: 308f8719055de178897f66cbb72d6a02567050ac645dd5eca52f48de347dda6c - 1.14.3: 0486629e1599c3bccded279f6555ff22691958cde56203ceca099af6f2407263 - 1.14.2: 409ebdcb4935b004ce0efa8ada4aaf8d4dd63b77cde1d0acdf55664c168acbd9 - 1.14.1: 25f85c85b9ae15de589ac02d2b766178967d29122325f9479ab068534b7a9658 - 1.11.2: 9e1aeb86bce609eccff46a8b976ed06994bca27d639e564fd45756786c4d0123 - 1.11.1: c8b0d243f6ac4fb02665c157b5404e5184bdc9240dbdcdde0ccef2db352ce97a - 1.9.2: 1ad8bd3c1aa693f59133c480aa13bbdf6d81e4528e72ce955612c6bae8cb1720 - amd64: - 1.14.4: 4f170aaa10d2ef02560cfb60b67ddfa1a83b1b4f7018227e9cb23a6af3955ec1 - 1.14.3: 80c5ab9422d4672f650f2bad3da933568349b64117d055486abc3534517be2af - 1.14.2: 4d3a64961ea9e6a1313ab807f86a17bc6ebcecad2df84a120322fddebff00bcf - 1.14.1: a30afd16bbf7eed9d9ce662062f64ef9fbb5d7c76963668c33e90a5693941fbd - 1.11.2: acb62839ab8615f0e2485e8d71272b5659cbe35182eb24c5e96bd213240567fe - 1.11.1: ca8c9cef23f4a3f7a635ee58a3d9fa35e768581fda89dc3b6baed219cc407a02 - 1.9.2: 2bb60bcd5652cb17e44f66f0b8ae48195434bd1d66593db97fba85c7778eac53 - ppc64le: - 1.14.4: 0 - 1.14.3: 0 - 1.14.2: 0 - 1.14.1: 0 - 1.11.2: 0 - 1.11.1: 0 - 1.9.2: 0 -youki_checksums: - arm: - 0.3.2: 0 - 0.3.1: 0 - 0.3.0: 0 - 0.2.0: 0 - 0.1.0: 0 - 0.0.5: 0 - 0.0.4: 0 - arm64: - 0.3.2: 0 - 0.3.1: 0 - 0.3.0: 0 - 0.2.0: 0 - 0.1.0: 0 - 0.0.5: 0 - 0.0.4: 0 - amd64: - 0.3.2: 0 - 0.3.1: 0 - 0.3.0: 741ba3cd85d768bebba02598cedcf3b15a2160e4d6ce33a3d5c4e1b3080f9c1c - 0.2.0: b268689a91db07feebfd41d5806b10c7d051fbcbf7efb15076e2228763ac0762 - 0.1.0: f00677e9674215b44f140f0c0f4b79b0001c72c073d2c5bb514b7a9dcb13bdbc - 0.0.5: 8504f4c35a24b96782b9e0feb7813aba4e7262c55a39b8368e94c80c9a4ec564 - 0.0.4: c213376393cb16462ef56586e68fef9ec5b5dd80787e7152f911d7cfd72d952e - ppc64le: - 0.3.2: 0 - 0.3.1: 0 - 0.3.0: 0 - 0.2.0: 0 - 0.1.0: 0 - 0.0.5: 0 - 0.0.4: 0 -kata_containers_binary_checksums: - arm: - 3.2.0: 0 - 3.1.3: 0 - 3.1.2: 0 - 3.1.1: 0 - 3.1.0: 0 - 3.0.2: 0 - 3.0.1: 0 - arm64: - 3.2.0: 0 - 3.1.3: 0 - 3.1.2: 0 - 3.1.1: 0 - 3.1.0: 0 - 3.0.2: 0 - 3.0.1: 0 - amd64: - 3.2.0: 21bb8484a060450d6522f29bed7d88d773c28520774eaa2c522b6f47fd12c4a1 - 3.1.3: 266c906222c85b67867dea3c9bdb58c6da0b656be3a29f9e0bed227c939f3f26 - 3.1.2: 11a2921242cdacf08a72bbce85418fc21c2772615cec6f3de7fd371e04188388 - 3.1.1: 999bab0b362cdf856be6448d1ac4c79fa8d33e79a7dfd1cadaafa544f22ade83 - 3.1.0: 452cc850e021539c14359d016aba18ddba128f59aa9ab637738296d9b5cd78a0 - 3.0.2: a32dc555ffae23f3caab3bc57b03d5ed7792f651221f6cb95cdfe906e18c4bd1 - 3.0.1: e2505482f68cc1b1417b8011f2755bf87171a8dd6daaace28531746118fbddaa - ppc64le: - 3.2.0: 0 - 3.1.3: 0 - 3.1.2: 0 - 3.1.1: 0 - 3.1.0: 0 - 3.0.2: 0 - 3.0.1: 0 -gvisor_runsc_binary_checksums: - arm: - 20240305: 0 - 20240212: 0 - 20240206: 0 - 20240129: 0 - 20240122: 0 - 20240115: 0 - 20240109: 0 - 20231218: 0 - arm64: - 20240305: b8b54b45fed2dd1fa14decefecc68c8da605b8abaaee97a0550deeee4afc427f - 20240212: a03fb515df9cabf1c618193e9ed7400543c0410ab7107d1ce291ebc9212521cf - 20240206: 50b637dcb7c1b2fb1c1ce189a48ca6732d4b5a5c17ac08d5dd22d33b06fd31c8 - 20240129: d2ecc989f27d40a0e7cd53f0712fa91405b1eef2cb466deccffa41a7f607bacd - 20240122: ae9507f4ff950dc315e7dea2c4b0086dce66b88b8c8bac2008d8e754bac7af7a - 20240115: 7b2ce18408212542477c31cc1bd0ddddf6fbf7439d57e56f6884091f62c81cd8 - 20240109: 51a1b299997834b902192806def688b1e23ff6b14f28a9ed3397f3f6572a189a - 20231218: 86262a78946deacc309c0f08883659ee3298c288048dc30955945e71993c81a8 - amd64: - 20240305: 3b949f7fab2c7d3d75df09fe5f170b46951e62b8833dcc4abad0a4d6c12f41f3 - 20240212: da5390680d18c3f98f1e88cd7363f97de42ed63a767e61d476b1740b0918b93c - 20240206: 996a8e855c1d54a7dcf688d52ee698fd714f0fd143c42ee793707e7f4f18124d - 20240129: b7765ea92c0100fcd1d03c7b23073c9be9486350cf38ffcbb72eb7915fe26605 - 20240122: d184712583d543b8f56a28e8583a1fa55c7256e77934123fe21c621e0d9b975c - 20240115: 9ae176da972b288880e69b1a438052eea2c502b6292aea8a1a33fbcf65e135dd - 20240109: f32810820c81a4dfe570080c06c5dabfc1be74ec0d5da659f93ae5cc1fc5c098 - 20231218: c353d36a134dfc2fab8509f72a34abf6a761603975eb00a39e4077c41aeaf31b - ppc64le: - 20240305: 0 - 20240212: 0 - 20240206: 0 - 20240129: 0 - 20240122: 0 - 20240115: 0 - 20240109: 0 - 20231218: 0 -gvisor_containerd_shim_binary_checksums: - arm: - 20240305: 0 - 20240212: 0 - 20240206: 0 - 20240129: 0 - 20240122: 0 - 20240115: 0 - 20240109: 0 - 20231218: 0 - arm64: - 20240305: 466c51e4f4bf592da0edf8c70c70ba74f026bb48f980bb28ffb582a93c88c049 - 20240212: 4b122fd5684c068d5d73189a30a8130cc5280aefadda0b8532321446c9c79c90 - 20240206: 34ded13729aeea0bee6c6d4cbc57ac19a9f4a532631b307ae975cbeb2a09a4ff - 20240129: 41c033549c24c13c776db42d212a416a2df20a6cff57cc26f70df8cdff738441 - 20240122: e5f3dbcd7f1b1fb9f46e1432656a8b07dda63a5c65fdbe639062761439df23c0 - 20240115: eae0a657656c4153db44dd51ca285b423b44c4eaad872ea56c18b6a430cdfda5 - 20240109: 40eb0a4f5f0013afb221e228fd6e71887127c4b09c7f2eb36705a0cd5c746d57 - 20231218: 5f66938de981221359a64f05a5c770b228090db3a2697d91ad622c18dd19f4b2 - amd64: - 20240305: 11a1b482e0ed6c72ea6ca72692e1cb2d0794214d142be5389e30517a96b157dc - 20240212: 48333e9b6158f8d4192a35e1d1f74319b6a083d6cbc3779c847548de6a5faf5f - 20240206: 9c88e82b71dc07f689c74f61143ea00fa8621a6d5c31c5fadb9714ad3be8465a - 20240129: 840b4b9d47bd04f3dfed6cf8fbee7c2c4a697e17461c22afb873d67499d4d9b9 - 20240122: cd7d9e4bb4cb0ac8242d15fc03580880f53eb36ebd9fb8d686e2811e86ad698e - 20240115: b95d05f667f1040cb07f262f27396d1deb23573ce4c4a31ea3568e6ca3b70c24 - 20240109: d677683326cfd42c7913636651f74ffd1a6866066877903d8a58c644422c2e18 - 20231218: a0578a357feb9320298730bf5ba683880ba35c476dc74dc82c79f0b5acc42656 - ppc64le: - 20240305: 0 - 20240212: 0 - 20240206: 0 - 20240129: 0 - 20240122: 0 - 20240115: 0 - 20240109: 0 - 20231218: 0 -nerdctl_archive_checksums: - arm: - 1.7.6: 4c48463659b09636aa23b50825f85cdc38901b6c42e321f69a589d89f6e1d0d5 - 1.7.5: 2d258a7d67e9fa808424ad42f9299a0feb318cafd2758f0287748acedeee4c0d - 1.7.4: 91d3a8bcc2247dd80f8f5769419e6f344dea412937de4c318f65d8e9bf01355b - 1.7.3: 44369f34a98e5955eb02e41779b1a470332194e4c2bef136fe471943eaf8057a - 1.7.2: d952c1cbe3d25478bbed5f4ee7af4bb52fa4ed47e43802dc5eb2888a4c8da704 - 1.7.1: 799d35de7a182da35d850308c7f1787cd7321404348ff2d5ba64ad43b06b395a - 1.7.0: 8b9e7cccbcc0a472685d1bc285f591f41005f8699e7265ea5438a3e06aefdcfd - arm64: - 1.7.6: 4fa0a6e936c7a9cb9bb81e784fddaa593cb00afb48b08842e3f0503748c21348 - 1.7.5: a53d87fc7d1f4ffeec55e5e08d2397b02ada0d334874c3cece306ad36f828a6c - 1.7.4: d8df47708ca57b9cd7f498055126ba7dcfc811d9ba43aae1830c93a09e70e22d - 1.7.3: e4f16b78d884768f6997558130146ba9bd7846828b19fa2ca8e8eda988953fd7 - 1.7.2: de68d5380d65604cd26c164988547cf46b698f7819a5d51d98e3a0f031f5594d - 1.7.1: 46affa0564bb74f595a817e7d5060140099d9cfd9e00e1272b4dbe8b0b85c655 - 1.7.0: 1255eea5bc2dbac9339d0a9acfb0651dda117504d52cd52b38cf3c2251db4f39 - amd64: - 1.7.6: 0326d6a42dbec5c104ed9d7aa8cbc62727433dbe000cf21cc29d06b22507e0f0 - 1.7.5: 775f8bddd5e93acc4162c568dd6b84d5925549180991b83cfd4b7e33d4844921 - 1.7.4: 71aee9d987b7fad0ff2ade50b038ad7e2356324edc02c54045960a3521b3e6a7 - 1.7.3: ee93ffe6f90e50bde153a9a0dd779594e0bc13a26949053965958b91b6dffdd0 - 1.7.2: aed7d33d645bfb97c8df978d952a1e1f7e02b0b3ed2c0089ee4285af7f8f971b - 1.7.1: 5fc0a6e8c3a71cbba95fbdb6833fb8a7cd8e78f53de10988362d4029c14b905a - 1.7.0: 844c47b175a3d6bc8eaad0c51f23624a5ef10c09e55607803ec2bc846fb04df9 - ppc64le: - 1.7.6: 89906f9bcdf8d5bd866646c43e14c0ae15a83ba3ebed44b06c3629a11517e242 - 1.7.5: 8e0891f608144d8d751070edea5cd98d2a76a053ad7fa6b9d4aae94a700aaea2 - 1.7.4: 97c99ab6030ffac1fb780fe012de06a36512b17b13de5c99445468b5a5fe5a62 - 1.7.3: e63ae0a8f5ccd12877ff944b609d0a4c55c97ba79808ab16c7dc7e99fd8f3dd6 - 1.7.2: e5c01702d3cec0763d28bd3cf6ea9c3efc58662a93cb4e15669a839782af10d7 - 1.7.1: 09fd0cbef25c98e08c5cc2d1e39da279cbf66c430fdf6c8738e56ce8f949dad9 - 1.7.0: e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd -containerd_archive_checksums: - arm: - 1.7.21: 0 - 1.7.20: 0 - 1.7.19: 0 - 1.7.18: 0 - 1.7.17: 0 - 1.7.16: 0 - 1.7.15: 0 - 1.7.14: 0 - 1.7.13: 0 - 1.7.12: 0 - 1.7.11: 0 - 1.7.10: 0 - 1.7.9: 0 - 1.7.8: 0 - 1.7.7: 0 - 1.7.6: 0 - 1.7.5: 0 - 1.7.4: 0 - 1.7.3: 0 - 1.7.2: 0 - 1.7.1: 0 - 1.7.0: 0 - 1.6.34: 0 - 1.6.33: 0 - 1.6.32: 0 - 1.6.31: 0 - 1.6.30: 0 - 1.6.29: 0 - 1.6.28: 0 - 1.6.27: 0 - 1.6.26: 0 - 1.6.25: 0 - 1.6.24: 0 - 1.6.23: 0 - 1.6.22: 0 - 1.6.21: 0 - 1.6.20: 0 - 1.6.19: 0 - 1.6.18: 0 - 1.6.17: 0 - 1.6.16: 0 - 1.6.15: 0 - 1.6.14: 0 - arm64: - 1.7.21: 7b6b67d998eb86856d23df5d57269c054539072bbb27677975cf78269b2c5c10 - 1.7.20: cf80cd305f7d1c23aaf0c57bc1c1e37089cad9130d533db6fe968cdebd16c759 - 1.7.19: 1839e6f7cd7c62d9df3ef3deac3f404cdd5cd47bbdf8acfeb0b0f3776eb20002 - 1.7.18: e80ce87b469af03b3bdcf68b95f0f4a303787ae247581bcd42f04acf1ad4c24d - 1.7.17: 8d9749985796a208e860afe331ec77cb485566104e5cc7c0b5e9e82ec7681969 - 1.7.16: 2d4373de40a6f58cd0f29377c0257b35697a987248e6268520586996771d7a75 - 1.7.15: 5cc8bd8f3d9803ef0ef701596e89d62ad6850a2544e722842f4533642df36d87 - 1.7.14: 44df66d0a0332465e7d15e90b974cd4f08d059dfa26652218ed9485390f47f9e - 1.7.13: 118759e398f35337109592b4d237538872dc12a207d38832b9d04515d0acbc4d - 1.7.12: 8a1b35a521d071a8828f63fe007a51e5b7ac863a1195f5dee32543b1a9d5f2b6 - 1.7.11: 5eae27cce38a14be5390d4035127aa11416bc5ae592a9ff25b11870872ce1159 - 1.7.10: 0667b12a04a896a61cf508a4a77190c280f4a1fa35f38c8a4ba63f605b5ec375 - 1.7.9: 09ca326dee14e00c439137071747c15cc280480e2c26c1e82698c992dd1889c6 - 1.7.8: 3fc551e8f51150804d80cc1958a271bd2252b6334f0355244d0faa5da7fa55d1 - 1.7.7: 0a104f487193665d2681fcb5ed83f2baa5f97849fe2661188da835c9d4eaf9e3 - 1.7.6: d844a1c8b993e7e9647f73b9814567004dce1287c0529ce55c50519490eafcce - 1.7.5: 98fc6990820d52d45b56ea2cda808157d4e61bb30ded96887634644c03025fa9 - 1.7.4: ea5a04379bd4252fc1e0b7b37f69cd516350c5269054483535d6eab7a0c79d2e - 1.7.3: 85d2eaedabff57ac1d7cd3884bf232155c4c46491f6b071982e4f7b684b74445 - 1.7.2: d75a4ca53d9addd0b2c50172d168b12957e18b2d8b802db2658f2767f15889a6 - 1.7.1: 1f828dc063e3c24b0840b284c5635b5a11b1197d564c97f9e873b220bab2b41b - 1.7.0: e7e5be2d9c92e076f1e2e15c9f0a6e0609ddb75f7616999b843cba92d01e4da2 - 1.6.34: 9e898686ff003cec2d80c30cf5ad342c1ac88373568dae792f93cd088e66d038 - 1.6.33: 432cf17fbc01ba4fc59b949210baa96865185b8eb3b3292eb7a00e2f6bde9fe9 - 1.6.32: a9cb16bafbf1eb8cea11b4803d76f78cf7bef311b951dd1ae49c238bb41ec649 - 1.6.31: 91a74cc602c7724668537f754006692114af70cfb6ef840b288f922fa68f7ed7 - 1.6.30: 0bbf1eed508d6ebc240b900648c76f12a07c0c6125aa8c22d46c9ce24252f9e3 - 1.6.29: 0 - 1.6.28: 96a231f875ddf9cc7682b881d408ae993f2bd5d0a40402a74ec4fda672047427 - 1.6.27: 433b0e8113adfd726374e04fc2f61dafad65c53db5665569f2715a7a916a1813 - 1.6.26: 177bed65b6425255bacbe48d99ea7aa5209d381576962c0962dc8615ef16c5c5 - 1.6.25: 4948677cfc5f98a1d5d46cec90d6d6f84f6b27cd6d28fd87f7f5936d61580ceb - 1.6.24: 1d741e9e2d907f02a8b2a46034a28ff9aacdba88c485cef2f4bad18be9ea23ba - 1.6.23: ea7afb82dc5789307e684ef9b4a55ce1ee9a05dc02c2118df640b01207208c45 - 1.6.22: 7882d6e7f4e97dcba041c37592c4cb9e7a5b4d972380c74d959e388b12d57d01 - 1.6.21: d713d8fbec491705ffe8c33ecc9051a904f6eedc92574928e1d33616f291c583 - 1.6.20: c3e6a054b18b20fce06c7c3ed53f0989bb4b255c849bede446ebca955f07a9ce - 1.6.19: 25a0dd6cce4e1058824d6dc277fc01dc45da92539ccb39bb6c8a481c24d2476e - 1.6.18: 56b83a0bc955edc5ebaa3bd0f788e654b63395be00fcb1bd03ff4bdfe4b5e1e7 - 1.6.17: 7e110faa738bff2f5f0ffd54c4ec2c17c05fd2af6de4877c839794ca3dadd61c - 1.6.16: c2bf51fde02ec9cf8b9c18721bc4f53bd1f19fb2bb3251f41ece61af7347e082 - 1.6.15: d63e4d27c51e33cd10f8b5621c559f09ece8a65fec66d80551b36cac9e61a07d - 1.6.14: 3ccb61218e60cbba0e1bbe1e5e2bf809ac1ead8eafbbff36c3195d3edd0e4809 - amd64: - 1.7.21: 3d1fcdfd0b141f4dc4916b7aee7f9a7773dc344baffc8954e1ca66b1adc5c120 - 1.7.20: e09410787b6f392748959177a84e024424f75d7aff33ea1c5b783f2260edce67 - 1.7.19: 97f75e60f0ad19d335b1d23385835df721cad4492740d50576997f2717dc3f94 - 1.7.18: a24b05b341c155a0ec367d3d0fd1d437c09a0261dffdecc0e44e9abbf2d02aca - 1.7.17: 04cf937349f82d29fe98553ff45a7e9ea2ed6b81fe6514e3679cf263b50409ff - 1.7.16: 4f4f2c3c7d14fd59a404961a3a3341303c2fdeeba0e78808c209f606e828f99c - 1.7.15: ea27e6454954bd9cb62a70b0a40eb085ae9c96cb8c075a74910102b33586e07d - 1.7.14: 48e0d9747cd51cb90e0b278d100397653d9f2e765effca194427e4796395b240 - 1.7.13: c2371c009dd8b7738663333d91e5ab50d204f8bcae24201f45d59060d12c3a23 - 1.7.12: 6a24d8b996533fa1b0d7348fe9813a78cd01fa16cff865a961ad0d556f5cd665 - 1.7.11: d66161d54546fad502fd50a13fcb79efff033fcd895adc9c44762680dcde4e69 - 1.7.10: eacb0296bff2ae5225a18492dcb32fb28ad4a1fe0a39ea9073367c7e43dc5838 - 1.7.9: ccd5b434393666f6ebbc90eea959ffd3e61958a1e3e1cc830a678f040142d4b0 - 1.7.8: 5f1d017a5a7359514d6187d6656e88fb2a592d107e6298db7963dbddb9a111d9 - 1.7.7: 371de359d6102c51f6ee2361d08297948d134ce7379e01cb965ceeffa4365fba - 1.7.6: 58408cfa025003e671b0af72183b963363d519543d0d0ba186037e9c57489ffe - 1.7.5: 33609ae2d5838bc5798306a1ac30d7f2c6a8cff785ca6253d2be8a8b3ccbab25 - 1.7.4: fc070fabfe3539d46ae5db160d18381270928b3f912e2e800947e9fbd43f510c - 1.7.3: de7f61aacba88ee647a7dcde1ca77672ec44ab9fb3e58ae90c0efc9b2d8f3068 - 1.7.2: 2755c70152ab40856510b4549c2dd530e15f5355eb7bf82868e813c9380e22a7 - 1.7.1: 9504771bcb816d3b27fab37a6cf76928ee5e95a31eb41510a7d10ae726e01e85 - 1.7.0: b068b05d58025dc9f2fc336674cac0e377a478930f29b48e068f97c783a423f0 - 1.6.34: 18969d667cd6b9993d168f6d30f9ad978f0aca72cf984c1f522fc5277780885b - 1.6.33: a0c7daa50386dc3ca19cbeb83d6987d43bdd92c0bb0429d08be7f9be4f9c307a - 1.6.32: 7acab4dda6edb7e8e0a6cfc3abd9f323db05a3d92a8a1842de8f6c9e28af501d - 1.6.31: 52080601f414b7e63a5b8e0cb8c1d641c9e070447ac96da9b1aeb00480744ba5 - 1.6.30: 1f1b65190b626883394e6f2ecbe5141afc6c45fc1ca035ef052e66bb2c479a5f - 1.6.29: 0 - 1.6.28: b2f15c722d1cc8b74ed643068e043b92bd031fc23d53488d1e837cf4b2777391 - 1.6.27: 8c0b04a8b39127c084d490cca905d565c94929dd15e168b0f8663076fdcf5539 - 1.6.26: fa806d3e945a8ad25aa1f8123a98524768ead83af2ed1ab3d922d2dd5fe6b14c - 1.6.25: 878b331b5fa65df3d33c68ee355724de0044c25071486086409b374a9c62d145 - 1.6.24: a56fac5ba03c3d6f74ceae14abdc9fafabcba900105e9890c0ac895cc00164ad - 1.6.23: bcf16bb63a295721a2603e9a56602c5d18e5443df04a9f2c1ca5328f41556fcc - 1.6.22: 5671eb4eba97f0ec98223c84401c9aeb21d0ef16ac3ece3eb8fadd46174d7eab - 1.6.21: 04dcc1b99368492caee758583e531392683268197e58156888a3cea2941117b6 - 1.6.20: bb9a9ccd6517e2a54da748a9f60dc9aa9d79d19d4724663f2386812f083968e2 - 1.6.19: 3262454d9b3581f4d4da0948f77dde1be51cfc42347a1548bc9ab6870b055815 - 1.6.18: c4e516376a2392520a87abea94baf2045cc3a67e9e0c90c75fb6ed038170561e - 1.6.17: 5f0584d000769d0cf08fc0e25135614ef5bf52971a6069175c78437699f3b8d4 - 1.6.16: 2415b431a900275c14942f87f751e1e13d513c1c2f062322b5ca5a9a2190f22a - 1.6.15: 191bb4f6e4afc237efc5c85b5866b6fdfed731bde12cceaa6017a9c7f8aeda02 - 1.6.14: 7da626d46c4edcae1eefe6d48dc6521db3e594a402715afcddc6ac9e67e1bfcd - ppc64le: - 1.7.21: 5ce0c1125e8d9ca04e2b524a2bac8b1eb97876c073023d5e083f7da64fcd8207 - 1.7.20: dc611df0baa90509dda35e0be993da52f42b067514329fcf538d000b110364e8 - 1.7.19: f41c2f28ee933a9ca24ff02cca159099fbcf798850e56cf0b7a6047ebe21fa86 - 1.7.18: d6cfb3bc8fbdead7d435d5f3f6b1913b5896f7f97102c1bbad206f9123c2a5d3 - 1.7.17: 873b76a507d362eec73887f61fa1400f3a892c7dbed1759f5dad2b654095b534 - 1.7.16: d0add7a55a5d4411cafb276469d2b78bc3ada11cb4b444b9e35f9ef60c00960d - 1.7.15: b38641d9bd18139495cf9839999039b19941f53d36a6d72efe4577c489dfda0c - 1.7.14: b84b523909b9dd0c0b2bc40bd2b9af543ec9f1186df69c220ae3749e34623dbb - 1.7.13: 89605ed2365d5eb779477d11947101236eb44e5244f1e58bb162a9e68d242798 - 1.7.12: 80f16891b387d86712026234de7d4d0365a38106dbe5e51b65b1200b24822721 - 1.7.11: 6f91c5dabdccd1fc75aae8687381bb185b9eb4200beb29d0993dea8175f5fa61 - 1.7.10: 15a5191bf7c555956a8565d8786399d51b13f2718d59b1a5b2bd380fc420bf8a - 1.7.9: 174b8af2d878ad8410205b9ba44fa8d2a9683a521abf13f168f67b7f7375d5b3 - 1.7.8: 2b563df9e1bddc96a99a023963c99b5faf3066d3fcbc23ff44ba24229e939444 - 1.7.7: 0335e7447ed84757489337686a709e95ffa379a8780f238725abb10facaeaa7f - 1.7.6: 956fadb01b35c3214f2b6f82abc0dda3e1b754cb223cd24e818334b08cb09fb2 - 1.7.5: 2496e24a95fa74750363a8a7e2ac36acf8d41ee2e4b67a452154ad4c8efbc4bc - 1.7.4: c3397f67fb5756e6336ff76eeb34dfad7ad66235877a4186d82044c7a4caf482 - 1.7.3: d1977922e74147782dd5bb488f260ee14d758d29a7651cd97bc2e6c7cc1a3cce - 1.7.2: cbe7ec913cb603ca218bd8867efdce4bee3b0e0115e467e51c910467daf8184e - 1.7.1: 17d97ef55c6ce7af9778dbafb5e73f577d1b34220043a91cccde49dbcc610342 - 1.7.0: 051e897d3ee5b8c8097f65be447fea2d29226b583ca5d9ed78e9aebcf4e69889 - 1.6.34: 14a4392ba4e533e313fe6d3ed1a68cfdce038b87ad4693be6e71ff31568e2173 - 1.6.33: 0a77fba37290a40a7853dbd7e5a297288d3657f7e92cd7864bc7187189a0a370 - 1.6.32: d733e4b66ca2bc8191ae5e8770e4806ebd4094fdc657258045b925930ad9bfc5 - 1.6.31: 4458a2398f27241b6e674ea9ba1f56dc4d9ab9dacc5a07469602776c3e428110 - 1.6.30: ba3d790f504a845b060e2faae3cc0603afd125ebdddb3bdb513b8d70a4337d87 - 1.6.29: 0 - 1.6.28: 35411f9d1bafc9cae91c2e30d46a59d01bffc7e18ac7f0942dca9d1d5907ab38 - 1.6.27: 8106915bc62c51383baa77925748505e79229fded7efcd7e74cb352ad10d0ce9 - 1.6.26: 75fb01a4bd3bcd16263c2f833b8e7081356e2e390dd7eb0710232cb04dac5a01 - 1.6.25: 3ddcc1739ffeb3e1df786d45518a01d93a5cef243eb6dee61cbdd4cd110bc723 - 1.6.24: abff9e7ec4cc21d19150d2bc55fc89cf53dc03c002cdaf5016ee82aedead9b03 - 1.6.23: 1099fce4a4dfc78712cc1c19be6d9f80e9321f513834dba0b2418bd5c78ad398 - 1.6.22: 0f8647aedd96174704a63a17b1a7cf4c4c5c2fc066606b1a419b2a860b754bfb - 1.6.21: 196d91799070a5ff2f5f3b6efe8516c5377f299d38012b6c0cf4ae77fc8c22c5 - 1.6.20: f3ee666fdd31031f07cbb7bad24f0181fad1094ba36273dc61f8fa5a570b5311 - 1.6.19: 18cf11b6dfc980aca8792a2cd3ea7afed6379c2988ca6fe9e53a19a0bece5a2d - 1.6.18: b7083473061a61200d04f500ad4a96813d1b09f71b2d427019076836c2a49836 - 1.6.17: 2f689ff36ba41c3c86ce926f55b0101118a40dd7b741946386062fddaa287db0 - 1.6.16: 9cfd5dade6a1c2671f5c76496395afe0aa0ce902c13672b306d8d09fdbb99492 - 1.6.15: 502f3e4c8ea2018aaa285fe4f704bfd560fdf93193bb829dd9302d013bc38370 - 1.6.14: 73025da0666079fc3bbd48cf185da320955d323c7dc42d8a4ade0e7926d62bb0 -skopeo_binary_checksums: - arm: - v1.15.0: 0 - v1.14.2: 0 - v1.14.1: 0 - v1.13.3: 0 - v1.13.2: 0 - v1.13.1: 0 - v1.13.0: 0 - arm64: - v1.15.0: bde8cc7e764d246281430d5da07ca906ee0838803199e3a6136a58802b2e0207 - v1.14.2: 364c46085de31edf4b312f13587442f4eade1f181bc5a9ea2ab2ffab5b575916 - v1.14.1: fd4fc0adae14f27788fd52cf0d23be2cfd1963e184c4af689de30185455e29a6 - v1.13.3: 1f7726b020ff9bc931ce16caa13c29999738a231f1414028282cd8f8661eb747 - v1.13.2: 520cc31c15796405b82d01c78629d5b581eced3512ca0b6b184ed82f5e18dc86 - v1.13.1: 3b7db2b827fea432aa8a861b5caa250271c05da70bd240aa4045f692eba52e24 - v1.13.0: d23e43323c0a441d1825f9da483b07c7f265f2bd0a4728f7daac4239460600a3 - amd64: - v1.15.0: 3cdbcde0163abb4c942f62d0302479d5aa4d31c5970d712841cf5d5f76edc594 - v1.14.2: 51218f93a2b079e36a36f7fbe2d2d86778be0a6947653031b4f9e254e2469224 - v1.14.1: 6b7776bcdf0c92af5d3f3c91a959d091011b42d839025b90f12b7201a083f308 - v1.13.3: 65707992885b1a4a446af6342874749478a1af7e17ab3f4df8fb89509e8b1966 - v1.13.2: 2f00be6ee1c4cbfa7f2452be90a1a2ce88fd92a6d0f6a2e9d901bd2087bd9092 - v1.13.1: 8c15c56a6caffeb863c17d73a6361218c04c7763e020fffc8d5d6745cacfa901 - v1.13.0: 8cb477ee25010497fc9df53a6205dbd9fe264dd8a5ea4e934b9ec24d5bdc126c - ppc64le: - v1.15.0: fb7f390f52f4b81f85d9bdce8715af5e27ee3969eff236b5f3c0f3a0b5a182e1 - v1.14.2: 0 - v1.14.1: 0 - v1.13.3: 0 - v1.13.2: 0 - v1.13.1: 0 - v1.13.0: 0 -yq_checksums: - arm: - v4.42.1: 4e3fe0c37793d28e96d465d9958fbf679d8c616e1857d0faf7980ad087f32aee - v4.41.1: ccd50344652c02574ca7dd123c7d66a06b391838e8ca6088b688e6edf2e25d0c - v4.40.7: fb922bb1e3974fbd15957feafb5e9bbabe43f4192999cf9b3e0e470815f2e0da - v4.40.6: 0 - v4.40.5: c587b2411e43d3fbcdd24c233fb558a362b5111a8446b23f9ce9a4a5665a7041 - v4.40.4: 2ff3f17483f2172a20130b16328114bfe6abd7d3068d66d8194a5093079e8529 - v4.40.3: 6a97856e8b4ef992ce08dcfdf97fec517cf612b1a89078406f401673f126c21c - arm64: - v4.42.1: 16a57531a594b66c3e0981cd93f9e9cd4b684a347b86eaf5e3f409074ad67eb8 - v4.41.1: 066aa930d74e39a25447b1900d8cbb3e1c7df72cd75bc203bc6ae5ee577a5b4a - v4.40.7: a84f2c8f105b70cd348c3bf14048aeb1665c2e7314cbe9aaff15479f268b8412 - v4.40.6: 0 - v4.40.5: 9431f0fa39a0af03a152d7fe19a86e42e9ff28d503ed4a70598f9261ec944a97 - v4.40.4: 79c61a1ebfedb165ec8c4678777775b52e2c581801f5d4cd80f97300852fe0f0 - v4.40.3: 44a5cca10d33019b8a46212882197be4f961dfe7deddde0af497065aa980a6a4 - amd64: - v4.42.1: 1a95960dddd426321354d58d2beac457717f7c49a9ec0806749a5a9e400eb45e - v4.41.1: ce0d5a61c256a463fd32f67f133e0c2948bc2cf77d44c42ff335a40e6bef34bf - v4.40.7: 4f13ee9303a49f7e8f61e7d9c87402e07cc920ae8dfaaa8c10d7ea1b8f9f48ed - v4.40.6: 0 - v4.40.5: 0d6aaf1cf44a8d18fbc7ed0ef14f735a8df8d2e314c4cc0f0242d35c0a440c95 - v4.40.4: f9163412d9aa2aa55e888fdcaf2b4053ada20074be35f701424caa7163100704 - v4.40.3: 6e9a5ed9591dbf1d13aaec4efaaf0ecdaf4945ea393b9ce01f4c3dea22311470 - ppc64le: - v4.42.1: d0d1cdbd2c4a7e6995433baf879cadaa47f6f12290e1661ea11933ed90baccb6 - v4.41.1: eed2af79d0ad787878b2d5c7c592e43ac152208d9ed432b42a43663167e276e8 - v4.40.7: ac0e8d06a7ed9afc108b4e2e9d6900312b01757f61b75fcecb809f15c39b10e7 - v4.40.6: 0 - v4.40.5: a1df9d2b872fbb30583526bf4f37f737dc1913b28606dfc1dafeaf56a8862b3d - v4.40.4: c67379085a44558825a60a8af3b59b400852b168356070829bc0f45c70553f45 - v4.40.3: 2fe818a0b141913a41548e0e727267479d0f755221c73f9e304788c8e9139a45 diff --git a/kubespray/project/roles/kubespray-defaults/tasks/fallback_ips.yml b/kubespray/project/roles/kubespray-defaults/tasks/fallback_ips.yml deleted file mode 100644 index ae3b151..0000000 --- a/kubespray/project/roles/kubespray-defaults/tasks/fallback_ips.yml +++ /dev/null @@ -1,35 +0,0 @@ ---- -# Set 127.0.0.1 as fallback IP if we do not have host facts for host -# ansible_default_ipv4 isn't what you think. -# Thanks https://medium.com/opsops/ansible-default-ipv4-is-not-what-you-think-edb8ab154b10 - -- name: Gather ansible_default_ipv4 from all hosts or specific hosts - setup: - gather_subset: '!all,network' - filter: "ansible_default_ipv4" - delegate_to: "{{ item }}" - delegate_facts: true - when: hostvars[item].ansible_default_ipv4 is not defined - loop: "{{ (ansible_play_hosts_all + [groups['kube_control_plane'][0]]) | unique if ansible_limit is defined else (groups['k8s_cluster'] | default([]) + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique }}" - run_once: true - ignore_unreachable: true - tags: always - -- name: Create fallback_ips_base - set_fact: - fallback_ips_base: | - --- - {% set search_hosts = (ansible_play_hosts_all + [groups['kube_control_plane'][0]]) | unique if ansible_limit is defined else (groups['k8s_cluster'] | default([]) + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique %} - {% for item in search_hosts %} - {% set found = hostvars[item].get('ansible_default_ipv4') %} - {{ item }}: "{{ found.get('address', '127.0.0.1') }}" - {% endfor %} - delegate_to: localhost - connection: local - delegate_facts: true - become: false - run_once: true - -- name: Set fallback_ips - set_fact: - fallback_ips: "{{ hostvars.localhost.fallback_ips_base | from_yaml }}" diff --git a/kubespray/project/roles/kubespray-defaults/tasks/main.yaml b/kubespray/project/roles/kubespray-defaults/tasks/main.yaml deleted file mode 100644 index 0a9d987..0000000 --- a/kubespray/project/roles/kubespray-defaults/tasks/main.yaml +++ /dev/null @@ -1,28 +0,0 @@ ---- -- name: Set facts variables - # do not run gather facts when bootstrap-os in roles - when: > - ansible_play_role_names | - intersect(['bootstrap-os', 'kubernetes_sigs.kubespray.bootstrap-os']) | - length == 0 - tags: - - always - block: - - name: Set fallback_ips - import_tasks: fallback_ips.yml - when: fallback_ips is not defined - - - name: Set no_proxy - import_tasks: no_proxy.yml - when: - - http_proxy is defined or https_proxy is defined - - no_proxy is not defined - -# TODO: Clean this task up when we drop backward compatibility support for `etcd_kubeadm_enabled` -- name: Set `etcd_deployment_type` to "kubeadm" if `etcd_kubeadm_enabled` is true - set_fact: - etcd_deployment_type: kubeadm - when: - - etcd_kubeadm_enabled is defined and etcd_kubeadm_enabled - tags: - - always diff --git a/kubespray/project/roles/kubespray-defaults/tasks/main.yml b/kubespray/project/roles/kubespray-defaults/tasks/main.yml new file mode 100644 index 0000000..e0b6105 --- /dev/null +++ b/kubespray/project/roles/kubespray-defaults/tasks/main.yml @@ -0,0 +1,10 @@ +--- +- name: Warn for usage of deprecated role + fail: + msg: kubespray-defaults is deprecated, switch to kubespray_defaults + ignore_errors: true # noqa ignore-errors + run_once: true + +- name: Compat for direct role import + import_role: + name: kubespray_defaults diff --git a/kubespray/project/roles/kubespray-defaults/vars/main.yml b/kubespray/project/roles/kubespray-defaults/vars/main.yml deleted file mode 100644 index c79edf5..0000000 --- a/kubespray/project/roles/kubespray-defaults/vars/main.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# Kubespray constants - -kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}" - -# The lowest version allowed to upgrade from (same as calico_version in the previous branch) -calico_min_version_required: "v3.19.4" - -containerd_min_version_required: "1.3.7" diff --git a/kubespray/project/roles/kubespray-defaults/defaults/main/download.yml b/kubespray/project/roles/kubespray_defaults/defaults/main/download.yml similarity index 71% rename from kubespray/project/roles/kubespray-defaults/defaults/main/download.yml rename to kubespray/project/roles/kubespray_defaults/defaults/main/download.yml index 687dc1d..2bfa13c 100644 --- a/kubespray/project/roles/kubespray-defaults/defaults/main/download.yml +++ b/kubespray/project/roles/kubespray_defaults/defaults/main/download.yml @@ -57,8 +57,7 @@ download_retries: 4 docker_image_pull_command: "{{ docker_bin_dir }}/docker pull" docker_image_info_command: "{{ docker_bin_dir }}/docker images -q | xargs -i {{ '{{' }} docker_bin_dir }}/docker inspect -f {% raw %}'{{ '{{' }} if .RepoTags }}{{ '{{' }} join .RepoTags \",\" }}{{ '{{' }} end }}{{ '{{' }} if .RepoDigests }},{{ '{{' }} join .RepoDigests \",\" }}{{ '{{' }} end }}' {% endraw %} {} | tr '\n' ','" nerdctl_image_info_command: "{{ bin_dir }}/nerdctl -n k8s.io images --format '{% raw %}{{ .Repository }}:{{ .Tag }}{% endraw %}' 2>/dev/null | grep -v ^:$ | tr '\n' ','" -# Using the ctr instead of nerdctl to workdaround the https://github.com/kubernetes-sigs/kubespray/issues/10670 -nerdctl_image_pull_command: "{{ bin_dir }}/ctr -n k8s.io images pull{% if containerd_registries_mirrors is defined %} --hosts-dir {{ containerd_cfg_dir }}/certs.d{%- endif -%}" +nerdctl_image_pull_command: "{{ bin_dir }}/nerdctl -n k8s.io pull --quiet" crictl_image_info_command: "{{ bin_dir }}/crictl images --verbose | awk -F ': ' '/RepoTags|RepoDigests/ {print $2}' | tr '\n' ','" crictl_image_pull_command: "{{ bin_dir }}/crictl pull" @@ -74,13 +73,13 @@ image_info_command_on_localhost: "{{ lookup('vars', image_command_tool_on_localh image_arch: "{{ host_architecture | default('amd64') }}" # Versions -crun_version: 1.14.4 -runc_version: v1.1.13 -kata_containers_version: 3.1.3 -youki_version: 0.1.0 -gvisor_version: 20240305 -containerd_version: 1.7.21 -cri_dockerd_version: 0.3.11 +crun_version: "{{ (crun_checksums['amd64'] | dict2items)[0].key }}" +runc_version: "{{ (runc_checksums['amd64'] | dict2items)[0].key }}" +kata_containers_version: "{{ (kata_containers_binary_checksums['amd64'] | dict2items)[0].key }}" +youki_version: "{{ (youki_checksums['amd64'] | dict2items)[0].key }}" +gvisor_version: "{{ (gvisor_runsc_binary_checksums['amd64'] | dict2items)[0].key }}" +containerd_version: "{{ (containerd_archive_checksums['amd64'] | dict2items)[0].key }}" +cri_dockerd_version: "{{ (cri_dockerd_archive_checksums['amd64'] | dict2items)[0].key }}" # this is relevant when container_manager == 'docker' docker_containerd_version: 1.6.32 @@ -100,69 +99,70 @@ github_image_repo: "ghcr.io" # TODO(mattymo): Move calico versions to roles/network_plugins/calico/defaults # after migration to container download -calico_version: "v3.28.1" +calico_version: "{{ (calicoctl_binary_checksums['amd64'] | dict2items)[0].key }}" calico_ctl_version: "{{ calico_version }}" calico_cni_version: "{{ calico_version }}" -calico_flexvol_version: "{{ calico_version }}" calico_policy_version: "{{ calico_version }}" calico_typha_version: "{{ calico_version }}" calico_apiserver_version: "{{ calico_version }}" typha_enabled: false calico_apiserver_enabled: false -flannel_version: "v0.22.0" -flannel_cni_version: "v1.1.2" +flannel_version: 0.22.0 +flannel_cni_version: 1.1.2 weave_version: 2.8.7 -cni_version: "v1.4.0" +cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}" -cilium_version: "v1.15.4" -cilium_cli_version: "v0.16.0" +cilium_version: "1.17.3" +cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}" cilium_enable_hubble: false -kube_ovn_version: "v1.12.21" -kube_ovn_dpdk_version: "19.11-{{ kube_ovn_version }}" -kube_router_version: "v2.0.0" -multus_version: "v3.8" -helm_version: "v3.15.4" -nerdctl_version: "1.7.6" -krew_version: "v0.4.4" -skopeo_version: "v1.15.0" +kube_ovn_version: "1.12.21" +kube_ovn_dpdk_version: "19.11-v{{ kube_ovn_version }}" +kube_router_version: "2.1.1" +multus_version: "4.1.0" +helm_version: "{{ (helm_archive_checksums['amd64'] | dict2items)[0].key }}" +nerdctl_version: "{{ (nerdctl_archive_checksums['amd64'] | dict2items)[0].key }}" +skopeo_version: "{{ (skopeo_binary_checksums['amd64'] | dict2items)[0].key }}" # Get kubernetes major version (i.e. 1.17.4 => 1.17) -kube_major_version: "{{ kube_version | regex_replace('^v([0-9])+\\.([0-9]+)\\.[0-9]+', 'v\\1.\\2') }}" +kube_major_version: "{{ (kube_version | split('.'))[:-1] | join('.') }}" pod_infra_supported_versions: - v1.30: "3.9" - v1.29: "3.9" - v1.28: "3.9" + '1.32': '3.10' + '1.31': '3.10' + '1.30': '3.9' pod_infra_version: "{{ pod_infra_supported_versions[kube_major_version] }}" etcd_supported_versions: - v1.30: "v3.5.12" - v1.29: "v3.5.12" - v1.28: "v3.5.12" + '1.32': 3.5.16 + '1.31': 3.5.16 + '1.30': 3.5.16 etcd_version: "{{ etcd_supported_versions[kube_major_version] }}" crictl_supported_versions: - v1.30: "v1.30.0" - v1.29: "v1.29.0" - v1.28: "v1.28.0" + '1.32': 1.32.0 + '1.31': 1.31.1 + '1.30': 1.30.1 crictl_version: "{{ crictl_supported_versions[kube_major_version] }}" crio_supported_versions: - v1.30: v1.30.3 - v1.29: v1.29.1 - v1.28: v1.28.4 + '1.32': 1.32.0 + '1.31': 1.31.3 + '1.30': 1.30.3 crio_version: "{{ crio_supported_versions[kube_major_version] }}" # Scheduler plugins doesn't build for K8s 1.29 yet scheduler_plugins_supported_versions: - v1.30: 0 - v1.29: 0 - v1.28: v0.28.9 + '1.31': 0 + '1.30': 0 + '1.29': 0 scheduler_plugins_version: "{{ scheduler_plugins_supported_versions[kube_major_version] }}" -yq_version: "v4.42.1" +yq_version: "{{ (yq_checksums['amd64'] | dict2items)[0].key }}" + +gateway_api_version: "1.2.1" +gateway_api_channel: "standard" github_url: https://github.com dl_k8s_io_url: https://dl.k8s.io @@ -170,30 +170,30 @@ storage_googleapis_url: https://storage.googleapis.com get_helm_url: https://get.helm.sh # Download URLs -kubelet_download_url: "{{ dl_k8s_io_url }}/release/{{ kube_version }}/bin/linux/{{ image_arch }}/kubelet" -kubectl_download_url: "{{ dl_k8s_io_url }}/release/{{ kube_version }}/bin/linux/{{ image_arch }}/kubectl" -kubeadm_download_url: "{{ dl_k8s_io_url }}/release/{{ kube_version }}/bin/linux/{{ image_arch }}/kubeadm" -etcd_download_url: "{{ github_url }}/etcd-io/etcd/releases/download/{{ etcd_version }}/etcd-{{ etcd_version }}-linux-{{ image_arch }}.tar.gz" -cni_download_url: "{{ github_url }}/containernetworking/plugins/releases/download/{{ cni_version }}/cni-plugins-linux-{{ image_arch }}-{{ cni_version }}.tgz" -calicoctl_download_url: "{{ github_url }}/projectcalico/calico/releases/download/{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}" -calico_crds_download_url: "{{ github_url }}/projectcalico/calico/archive/{{ calico_version }}.tar.gz" -ciliumcli_download_url: "{{ github_url }}/cilium/cilium-cli/releases/download/{{ cilium_cli_version }}/cilium-linux-{{ image_arch }}.tar.gz" -crictl_download_url: "{{ github_url }}/kubernetes-sigs/cri-tools/releases/download/{{ crictl_version }}/crictl-{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz" -crio_download_url: "{{ storage_googleapis_url }}/cri-o/artifacts/cri-o.{{ image_arch }}.{{ crio_version }}.tar.gz" -helm_download_url: "{{ get_helm_url }}/helm-{{ helm_version }}-linux-{{ image_arch }}.tar.gz" -runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/{{ runc_version }}/runc.{{ image_arch }}" +kubelet_download_url: "{{ dl_k8s_io_url }}/release/v{{ kube_version }}/bin/linux/{{ image_arch }}/kubelet" +kubectl_download_url: "{{ dl_k8s_io_url }}/release/v{{ kube_version }}/bin/linux/{{ image_arch }}/kubectl" +kubeadm_download_url: "{{ dl_k8s_io_url }}/release/v{{ kube_version }}/bin/linux/{{ image_arch }}/kubeadm" +etcd_download_url: "{{ github_url }}/etcd-io/etcd/releases/download/v{{ etcd_version }}/etcd-v{{ etcd_version }}-linux-{{ image_arch }}.tar.gz" +cni_download_url: "{{ github_url }}/containernetworking/plugins/releases/download/v{{ cni_version }}/cni-plugins-linux-{{ image_arch }}-v{{ cni_version }}.tgz" +calicoctl_download_url: "{{ github_url }}/projectcalico/calico/releases/download/v{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}" +calico_crds_download_url: "{{ github_url }}/projectcalico/calico/archive/v{{ calico_version }}.tar.gz" +ciliumcli_download_url: "{{ github_url }}/cilium/cilium-cli/releases/download/v{{ cilium_cli_version }}/cilium-linux-{{ image_arch }}.tar.gz" +crictl_download_url: "{{ github_url }}/kubernetes-sigs/cri-tools/releases/download/v{{ crictl_version }}/crictl-v{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz" +crio_download_url: "{{ storage_googleapis_url }}/cri-o/artifacts/cri-o.{{ image_arch }}.v{{ crio_version }}.tar.gz" +helm_download_url: "{{ get_helm_url }}/helm-v{{ helm_version }}-linux-{{ image_arch }}.tar.gz" +runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}" crun_download_url: "{{ github_url }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}" -youki_download_url: "{{ github_url }}/containers/youki/releases/download/v{{ youki_version }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux.tar.gz" -kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ ansible_architecture }}.tar.xz" +youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_architecture }}-gnu.tar.gz" +kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz" # gVisor only supports amd64 and uses x86_64 to in the download link gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/runsc" gvisor_containerd_shim_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_architecture }}/containerd-shim-runsc-v1" nerdctl_download_url: "{{ github_url }}/containerd/nerdctl/releases/download/v{{ nerdctl_version }}/nerdctl-{{ nerdctl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz" -krew_download_url: "{{ github_url }}/kubernetes-sigs/krew/releases/download/{{ krew_version }}/krew-{{ host_os }}_{{ image_arch }}.tar.gz" containerd_download_url: "{{ github_url }}/containerd/containerd/releases/download/v{{ containerd_version }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz" cri_dockerd_download_url: "{{ github_url }}/Mirantis/cri-dockerd/releases/download/v{{ cri_dockerd_version }}/cri-dockerd-{{ cri_dockerd_version }}.{{ image_arch }}.tgz" -skopeo_download_url: "{{ github_url }}/lework/skopeo-binary/releases/download/{{ skopeo_version }}/skopeo-linux-{{ image_arch }}" -yq_download_url: "{{ github_url }}/mikefarah/yq/releases/download/{{ yq_version }}/yq_linux_{{ image_arch }}" +skopeo_download_url: "{{ github_url }}/lework/skopeo-binary/releases/download/v{{ skopeo_version }}/skopeo-linux-{{ image_arch }}" +yq_download_url: "{{ github_url }}/mikefarah/yq/releases/download/v{{ yq_version }}/yq_linux_{{ image_arch }}" +gateway_api_crds_download_url: "{{ github_url }}/kubernetes-sigs/gateway-api/releases/download/v{{ gateway_api_version }}/{{ gateway_api_channel }}-install.yaml" etcd_binary_checksum: "{{ etcd_binary_checksums[image_arch][etcd_version] }}" cni_binary_checksum: "{{ cni_binary_checksums[image_arch][cni_version] }}" @@ -202,7 +202,6 @@ kubectl_binary_checksum: "{{ kubectl_checksums[image_arch][kube_version] }}" kubeadm_binary_checksum: "{{ kubeadm_checksums[image_arch][kube_version] }}" yq_binary_checksum: "{{ yq_checksums[image_arch][yq_version] }}" calicoctl_binary_checksum: "{{ calicoctl_binary_checksums[image_arch][calico_ctl_version] }}" -calico_crds_archive_checksum: "{{ calico_crds_archive_checksums[calico_version] }}" ciliumcli_binary_checksum: "{{ ciliumcli_binary_checksums[image_arch][cilium_cli_version] }}" crictl_binary_checksum: "{{ crictl_checksums[image_arch][crictl_version] }}" crio_archive_checksum: "{{ crio_archive_checksums[image_arch][crio_version] }}" @@ -215,7 +214,6 @@ kata_containers_binary_checksum: "{{ kata_containers_binary_checksums[image_arch gvisor_runsc_binary_checksum: "{{ gvisor_runsc_binary_checksums[image_arch][gvisor_version] }}" gvisor_containerd_shim_binary_checksum: "{{ gvisor_containerd_shim_binary_checksums[image_arch][gvisor_version] }}" nerdctl_archive_checksum: "{{ nerdctl_archive_checksums[image_arch][nerdctl_version] }}" -krew_archive_checksum: "{{ krew_archive_checksums[host_os][image_arch][krew_version] }}" containerd_archive_checksum: "{{ containerd_archive_checksums[image_arch][containerd_version] }}" skopeo_binary_checksum: "{{ skopeo_binary_checksums[image_arch][skopeo_version] }}" @@ -229,125 +227,115 @@ skopeo_binary_checksum: "{{ skopeo_binary_checksums[image_arch][skopeo_version] # And use --insecure-registry options for docker kube_proxy_image_repo: "{{ kube_image_repo }}/kube-proxy" etcd_image_repo: "{{ quay_image_repo }}/coreos/etcd" -etcd_image_tag: "{{ etcd_version }}" +etcd_image_tag: "v{{ etcd_version }}" flannel_image_repo: "{{ docker_image_repo }}/flannel/flannel" -flannel_image_tag: "{{ flannel_version }}" +flannel_image_tag: "v{{ flannel_version }}" flannel_init_image_repo: "{{ docker_image_repo }}/flannel/flannel-cni-plugin" -flannel_init_image_tag: "{{ flannel_cni_version }}" +flannel_init_image_tag: "v{{ flannel_cni_version }}" calico_node_image_repo: "{{ quay_image_repo }}/calico/node" -calico_node_image_tag: "{{ calico_version }}" +calico_node_image_tag: "v{{ calico_version }}" calico_cni_image_repo: "{{ quay_image_repo }}/calico/cni" -calico_cni_image_tag: "{{ calico_cni_version }}" -calico_flexvol_image_repo: "{{ quay_image_repo }}/calico/pod2daemon-flexvol" -calico_flexvol_image_tag: "{{ calico_flexvol_version }}" +calico_cni_image_tag: "v{{ calico_cni_version }}" calico_policy_image_repo: "{{ quay_image_repo }}/calico/kube-controllers" -calico_policy_image_tag: "{{ calico_policy_version }}" +calico_policy_image_tag: "v{{ calico_policy_version }}" calico_typha_image_repo: "{{ quay_image_repo }}/calico/typha" -calico_typha_image_tag: "{{ calico_typha_version }}" +calico_typha_image_tag: "v{{ calico_typha_version }}" calico_apiserver_image_repo: "{{ quay_image_repo }}/calico/apiserver" -calico_apiserver_image_tag: "{{ calico_apiserver_version }}" +calico_apiserver_image_tag: "v{{ calico_apiserver_version }}" pod_infra_image_repo: "{{ kube_image_repo }}/pause" pod_infra_image_tag: "{{ pod_infra_version }}" -netcheck_version: "v1.2.2" +netcheck_version: "1.2.2" netcheck_agent_image_repo: "{{ docker_image_repo }}/mirantis/k8s-netchecker-agent" -netcheck_agent_image_tag: "{{ netcheck_version }}" +netcheck_agent_image_tag: "v{{ netcheck_version }}" netcheck_server_image_repo: "{{ docker_image_repo }}/mirantis/k8s-netchecker-server" -netcheck_server_image_tag: "{{ netcheck_version }}" +netcheck_server_image_tag: "v{{ netcheck_version }}" netcheck_etcd_image_tag: "v3.4.17" weave_kube_image_repo: "{{ docker_image_repo }}/rajchaudhuri/weave-kube" weave_kube_image_tag: "{{ weave_version }}" weave_npc_image_repo: "{{ docker_image_repo }}/rajchaudhuri/weave-npc" weave_npc_image_tag: "{{ weave_version }}" cilium_image_repo: "{{ quay_image_repo }}/cilium/cilium" -cilium_image_tag: "{{ cilium_version }}" +cilium_image_tag: "v{{ cilium_version }}" cilium_operator_image_repo: "{{ quay_image_repo }}/cilium/operator" -cilium_operator_image_tag: "{{ cilium_version }}" +cilium_operator_image_tag: "v{{ cilium_version }}" cilium_hubble_relay_image_repo: "{{ quay_image_repo }}/cilium/hubble-relay" -cilium_hubble_relay_image_tag: "{{ cilium_version }}" +cilium_hubble_relay_image_tag: "v{{ cilium_version }}" cilium_hubble_certgen_image_repo: "{{ quay_image_repo }}/cilium/certgen" -cilium_hubble_certgen_image_tag: "v0.1.8" +cilium_hubble_certgen_image_tag: "v0.2.1" cilium_hubble_ui_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui" -cilium_hubble_ui_image_tag: "v0.11.0" +cilium_hubble_ui_image_tag: "v0.13.2" cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend" -cilium_hubble_ui_backend_image_tag: "v0.11.0" -cilium_hubble_envoy_image_repo: "{{ docker_image_repo }}/envoyproxy/envoy" -cilium_hubble_envoy_image_tag: "v1.22.5" +cilium_hubble_ui_backend_image_tag: "v0.13.2" +cilium_hubble_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy" +cilium_hubble_envoy_image_tag: "v1.32.5-1744305768-f9ddca7dcd91f7ca25a505560e655c47d3dec2cf" kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn" -kube_ovn_container_image_tag: "{{ kube_ovn_version }}" +kube_ovn_container_image_tag: "v{{ kube_ovn_version }}" kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway" -kube_ovn_vpc_container_image_tag: "{{ kube_ovn_version }}" +kube_ovn_vpc_container_image_tag: "v{{ kube_ovn_version }}" kube_ovn_dpdk_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn-dpdk" kube_ovn_dpdk_container_image_tag: "{{ kube_ovn_dpdk_version }}" kube_router_image_repo: "{{ docker_image_repo }}/cloudnativelabs/kube-router" -kube_router_image_tag: "{{ kube_router_version }}" +kube_router_image_tag: "v{{ kube_router_version }}" multus_image_repo: "{{ github_image_repo }}/k8snetworkplumbingwg/multus-cni" -multus_image_tag: "{{ multus_version }}" -external_openstack_cloud_controller_image_repo: "registry.k8s.io/provider-os/openstack-cloud-controller-manager" -external_openstack_cloud_controller_image_tag: "v1.30.0" +multus_image_tag: "v{{ multus_version }}" +external_openstack_cloud_controller_image_repo: "{{ kube_image_repo }}/provider-os/openstack-cloud-controller-manager" +external_openstack_cloud_controller_image_tag: "v1.32.0" -kube_vip_image_repo: "{{ github_image_repo }}/kube-vip/kube-vip" -kube_vip_image_tag: v0.8.0 +kube_vip_image_repo: "{{ github_image_repo }}/kube-vip/kube-vip{{ '-iptables' if kube_vip_lb_fwdmethod == 'masquerade' else '' }}" +kube_vip_image_tag: v0.8.9 nginx_image_repo: "{{ docker_image_repo }}/library/nginx" -nginx_image_tag: 1.25.2-alpine +nginx_image_tag: 1.27.4-alpine haproxy_image_repo: "{{ docker_image_repo }}/library/haproxy" -haproxy_image_tag: 2.8.2-alpine +haproxy_image_tag: 3.1.3-alpine # Coredns version should be supported by corefile-migration (or at least work with) # bundle with kubeadm; if not 'basic' upgrade can sometimes fail -coredns_version: "{{ 'v1.11.1' if (kube_version is version('v1.29.0', '>=')) else 'v1.10.1' }}" -coredns_image_is_namespaced: "{{ (coredns_version is version('v1.7.1', '>=')) }}" +coredns_version: "{{ '1.11.3' if (kube_version is version('1.30.5', '>=')) else '1.11.1' }}" +coredns_image_repo: "{{ kube_image_repo }}{{ '/coredns' if coredns_version is version('1.7.1', '>=') else '' }}/coredns" +coredns_image_tag: "{{ 'v' if coredns_version is version('1.7.1', '>=') else '' }}{{ coredns_version }}" -coredns_image_repo: "{{ kube_image_repo }}{{ '/coredns/coredns' if (coredns_image_is_namespaced | bool) else '/coredns' }}" -coredns_image_tag: "{{ coredns_version if (coredns_image_is_namespaced | bool) else (coredns_version | regex_replace('^v', '')) }}" - -nodelocaldns_version: "1.22.28" +nodelocaldns_version: "1.25.0" nodelocaldns_image_repo: "{{ kube_image_repo }}/dns/k8s-dns-node-cache" nodelocaldns_image_tag: "{{ nodelocaldns_version }}" -dnsautoscaler_version: v1.8.8 +dnsautoscaler_version: 1.8.8 dnsautoscaler_image_repo: "{{ kube_image_repo }}/cpa/cluster-proportional-autoscaler" -dnsautoscaler_image_tag: "{{ dnsautoscaler_version }}" +dnsautoscaler_image_tag: "v{{ dnsautoscaler_version }}" scheduler_plugins_controller_image_repo: "{{ kube_image_repo }}/scheduler-plugins/controller" -scheduler_plugins_controller_image_tag: "{{ scheduler_plugins_version }}" +scheduler_plugins_controller_image_tag: "v{{ scheduler_plugins_version }}" scheduler_plugins_scheduler_image_repo: "{{ kube_image_repo }}/scheduler-plugins/kube-scheduler" -scheduler_plugins_scheduler_image_tag: "{{ scheduler_plugins_version }}" +scheduler_plugins_scheduler_image_tag: "v{{ scheduler_plugins_version }}" registry_version: "2.8.1" registry_image_repo: "{{ docker_image_repo }}/library/registry" registry_image_tag: "{{ registry_version }}" -metrics_server_version: "v0.7.0" +metrics_server_version: "0.7.0" metrics_server_image_repo: "{{ kube_image_repo }}/metrics-server/metrics-server" -metrics_server_image_tag: "{{ metrics_server_version }}" -local_volume_provisioner_version: "v2.5.0" +metrics_server_image_tag: "v{{ metrics_server_version }}" +local_volume_provisioner_version: "2.5.0" local_volume_provisioner_image_repo: "{{ kube_image_repo }}/sig-storage/local-volume-provisioner" -local_volume_provisioner_image_tag: "{{ local_volume_provisioner_version }}" -cephfs_provisioner_version: "v2.1.0-k8s1.11" -cephfs_provisioner_image_repo: "{{ quay_image_repo }}/external_storage/cephfs-provisioner" -cephfs_provisioner_image_tag: "{{ cephfs_provisioner_version }}" -rbd_provisioner_version: "v2.1.1-k8s1.11" -rbd_provisioner_image_repo: "{{ quay_image_repo }}/external_storage/rbd-provisioner" -rbd_provisioner_image_tag: "{{ rbd_provisioner_version }}" -local_path_provisioner_version: "v0.0.24" +local_volume_provisioner_image_tag: "v{{ local_volume_provisioner_version }}" +local_path_provisioner_version: "0.0.24" local_path_provisioner_image_repo: "{{ docker_image_repo }}/rancher/local-path-provisioner" -local_path_provisioner_image_tag: "{{ local_path_provisioner_version }}" -ingress_nginx_version: "v1.11.2" +local_path_provisioner_image_tag: "v{{ local_path_provisioner_version }}" +ingress_nginx_version: "1.12.1" ingress_nginx_controller_image_repo: "{{ kube_image_repo }}/ingress-nginx/controller" ingress_nginx_opentelemetry_image_repo: "{{ kube_image_repo }}/ingress-nginx/opentelemetry" -ingress_nginx_controller_image_tag: "{{ ingress_nginx_version }}" +ingress_nginx_controller_image_tag: "v{{ ingress_nginx_version }}" ingress_nginx_opentelemetry_image_tag: "v20230721-3e2062ee5" ingress_nginx_kube_webhook_certgen_image_repo: "{{ kube_image_repo }}/ingress-nginx/kube-webhook-certgen" -ingress_nginx_kube_webhook_certgen_image_tag: "v1.4.3" +ingress_nginx_kube_webhook_certgen_image_tag: "v1.5.2" alb_ingress_image_repo: "{{ docker_image_repo }}/amazon/aws-alb-ingress-controller" alb_ingress_image_tag: "v1.1.9" -cert_manager_version: "v1.14.7" +cert_manager_version: "1.15.3" cert_manager_controller_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-controller" -cert_manager_controller_image_tag: "{{ cert_manager_version }}" +cert_manager_controller_image_tag: "v{{ cert_manager_version }}" cert_manager_cainjector_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-cainjector" -cert_manager_cainjector_image_tag: "{{ cert_manager_version }}" +cert_manager_cainjector_image_tag: "v{{ cert_manager_version }}" cert_manager_webhook_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-webhook" -cert_manager_webhook_image_tag: "{{ cert_manager_version }}" +cert_manager_webhook_image_tag: "v{{ cert_manager_version }}" csi_attacher_image_repo: "{{ kube_image_repo }}/sig-storage/csi-attacher" csi_attacher_image_tag: "v3.3.0" @@ -363,23 +351,23 @@ csi_livenessprobe_image_repo: "{{ kube_image_repo }}/sig-storage/livenessprobe" csi_livenessprobe_image_tag: "v2.5.0" snapshot_controller_supported_versions: - v1.30: "v7.0.2" - v1.29: "v7.0.2" - v1.28: "v7.0.2" + '1.32': "v7.0.2" + '1.31': "v7.0.2" + '1.30': "v7.0.2" snapshot_controller_image_repo: "{{ kube_image_repo }}/sig-storage/snapshot-controller" snapshot_controller_image_tag: "{{ snapshot_controller_supported_versions[kube_major_version] }}" -cinder_csi_plugin_version: "v1.30.0" +cinder_csi_plugin_version: "1.30.0" cinder_csi_plugin_image_repo: "{{ kube_image_repo }}/provider-os/cinder-csi-plugin" -cinder_csi_plugin_image_tag: "{{ cinder_csi_plugin_version }}" +cinder_csi_plugin_image_tag: "v{{ cinder_csi_plugin_version }}" -aws_ebs_csi_plugin_version: "v0.5.0" +aws_ebs_csi_plugin_version: "0.5.0" aws_ebs_csi_plugin_image_repo: "{{ docker_image_repo }}/amazon/aws-ebs-csi-driver" -aws_ebs_csi_plugin_image_tag: "{{ aws_ebs_csi_plugin_version }}" +aws_ebs_csi_plugin_image_tag: "v{{ aws_ebs_csi_plugin_version }}" -gcp_pd_csi_plugin_version: "v1.9.2" +gcp_pd_csi_plugin_version: "1.9.2" gcp_pd_csi_plugin_image_repo: "{{ kube_image_repo }}/cloud-provider-gcp/gcp-compute-persistent-disk-csi-driver" -gcp_pd_csi_plugin_image_tag: "{{ gcp_pd_csi_plugin_version }}" +gcp_pd_csi_plugin_image_tag: "v{{ gcp_pd_csi_plugin_version }}" azure_csi_image_repo: "mcr.microsoft.com/oss/kubernetes-csi" azure_csi_provisioner_image_tag: "v2.2.2" @@ -388,9 +376,9 @@ azure_csi_resizer_image_tag: "v1.3.0" azure_csi_livenessprobe_image_tag: "v2.5.0" azure_csi_node_registrar_image_tag: "v2.4.0" azure_csi_snapshotter_image_tag: "v3.0.3" -azure_csi_plugin_version: "v1.10.0" +azure_csi_plugin_version: "1.10.0" azure_csi_plugin_image_repo: "mcr.microsoft.com/k8s/csi" -azure_csi_plugin_image_tag: "{{ azure_csi_plugin_version }}" +azure_csi_plugin_image_tag: "v{{ azure_csi_plugin_version }}" gcp_pd_csi_image_repo: "gke.gcr.io" gcp_pd_csi_driver_image_tag: "v0.7.0-gke.0" @@ -406,11 +394,12 @@ dashboard_metrics_scraper_tag: "v1.0.8" metallb_speaker_image_repo: "{{ quay_image_repo }}/metallb/speaker" metallb_controller_image_repo: "{{ quay_image_repo }}/metallb/controller" -metallb_version: v0.13.9 +metallb_version: 0.13.9 +metallb_image_tag: "v{{ metallb_version }}" -node_feature_discovery_version: v0.16.4 +node_feature_discovery_version: 0.16.4 node_feature_discovery_image_repo: "{{ kube_image_repo }}/nfd/node-feature-discovery" -node_feature_discovery_image_tag: "{{ node_feature_discovery_version }}" +node_feature_discovery_image_tag: "v{{ node_feature_discovery_version }}" downloads: netcheck_server: @@ -418,7 +407,7 @@ downloads: container: true repo: "{{ netcheck_server_image_repo }}" tag: "{{ netcheck_server_image_tag }}" - sha256: "{{ netcheck_server_digest_checksum | default(None) }}" + checksum: "{{ netcheck_server_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -427,7 +416,7 @@ downloads: container: true repo: "{{ netcheck_agent_image_repo }}" tag: "{{ netcheck_agent_image_tag }}" - sha256: "{{ netcheck_agent_digest_checksum | default(None) }}" + checksum: "{{ netcheck_agent_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -435,11 +424,10 @@ downloads: container: "{{ etcd_deployment_type != 'host' }}" file: "{{ etcd_deployment_type == 'host' }}" enabled: true - version: "{{ etcd_version }}" dest: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ image_arch }}.tar.gz" repo: "{{ etcd_image_repo }}" tag: "{{ etcd_image_tag }}" - sha256: >- + checksum: >- {{ etcd_binary_checksum if (etcd_deployment_type == 'host') else etcd_digest_checksum | d(None) }} url: "{{ etcd_download_url }}" @@ -452,9 +440,8 @@ downloads: cni: enabled: true file: true - version: "{{ cni_version }}" dest: "{{ local_release_dir }}/cni-plugins-linux-{{ image_arch }}-{{ cni_version }}.tgz" - sha256: "{{ cni_binary_checksum }}" + checksum: "{{ cni_binary_checksum }}" url: "{{ cni_download_url }}" unarchive: false owner: "root" @@ -465,9 +452,8 @@ downloads: kubeadm: enabled: true file: true - version: "{{ kube_version }}" dest: "{{ local_release_dir }}/kubeadm-{{ kube_version }}-{{ image_arch }}" - sha256: "{{ kubeadm_binary_checksum }}" + checksum: "{{ kubeadm_binary_checksum }}" url: "{{ kubeadm_download_url }}" unarchive: false owner: "root" @@ -478,9 +464,8 @@ downloads: kubelet: enabled: true file: true - version: "{{ kube_version }}" dest: "{{ local_release_dir }}/kubelet-{{ kube_version }}-{{ image_arch }}" - sha256: "{{ kubelet_binary_checksum }}" + checksum: "{{ kubelet_binary_checksum }}" url: "{{ kubelet_download_url }}" unarchive: false owner: "root" @@ -491,9 +476,8 @@ downloads: kubectl: enabled: true file: true - version: "{{ kube_version }}" dest: "{{ local_release_dir }}/kubectl-{{ kube_version }}-{{ image_arch }}" - sha256: "{{ kubectl_binary_checksum }}" + checksum: "{{ kubectl_binary_checksum }}" url: "{{ kubectl_download_url }}" unarchive: false owner: "root" @@ -504,9 +488,8 @@ downloads: crictl: file: true enabled: true - version: "{{ crictl_version }}" dest: "{{ local_release_dir }}/crictl-{{ crictl_version }}-linux-{{ image_arch }}.tar.gz" - sha256: "{{ crictl_binary_checksum }}" + checksum: "{{ crictl_binary_checksum }}" url: "{{ crictl_download_url }}" unarchive: true owner: "root" @@ -517,9 +500,8 @@ downloads: crio: file: true enabled: "{{ container_manager == 'crio' }}" - version: "{{ crio_version }}" - dest: "{{ local_release_dir }}/cri-o.{{ image_arch }}.{{ crio_version }}tar.gz" - sha256: "{{ crio_archive_checksum }}" + dest: "{{ local_release_dir }}/cri-o.{{ image_arch }}.{{ crio_version }}.tar.gz" + checksum: "{{ crio_archive_checksum }}" url: "{{ crio_download_url }}" unarchive: true owner: "root" @@ -530,9 +512,8 @@ downloads: cri_dockerd: file: true enabled: "{{ container_manager == 'docker' }}" - version: "{{ cri_dockerd_version }}" dest: "{{ local_release_dir }}/cri-dockerd-{{ cri_dockerd_version }}.{{ image_arch }}.tar.gz" - sha256: "{{ cri_dockerd_archive_checksum }}" + checksum: "{{ cri_dockerd_archive_checksum }}" url: "{{ cri_dockerd_download_url }}" unarchive: true unarchive_extra_opts: @@ -545,9 +526,8 @@ downloads: crun: file: true enabled: "{{ crun_enabled }}" - version: "{{ crun_version }}" dest: "{{ local_release_dir }}/crun-{{ crun_version }}-{{ image_arch }}" - sha256: "{{ crun_binary_checksum }}" + checksum: "{{ crun_binary_checksum }}" url: "{{ crun_download_url }}" unarchive: false owner: "root" @@ -558,9 +538,8 @@ downloads: youki: file: true enabled: "{{ youki_enabled }}" - version: "{{ youki_version }}" - dest: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux.tar.gz" - sha256: "{{ youki_archive_checksum }}" + dest: "{{ local_release_dir }}/youki-{{ youki_version }}-{{ ansible_architecture }}.tar.gz" + checksum: "{{ youki_archive_checksum }}" url: "{{ youki_download_url }}" unarchive: true owner: "root" @@ -571,9 +550,8 @@ downloads: runc: file: true enabled: "{{ container_manager == 'containerd' }}" - version: "{{ runc_version }}" dest: "{{ local_release_dir }}/runc-{{ runc_version }}.{{ image_arch }}" - sha256: "{{ runc_binary_checksum }}" + checksum: "{{ runc_binary_checksum }}" url: "{{ runc_download_url }}" unarchive: false owner: "root" @@ -584,9 +562,8 @@ downloads: kata_containers: enabled: "{{ kata_containers_enabled }}" file: true - version: "{{ kata_containers_version }}" dest: "{{ local_release_dir }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz" - sha256: "{{ kata_containers_binary_checksum }}" + checksum: "{{ kata_containers_binary_checksum }}" url: "{{ kata_containers_download_url }}" unarchive: false owner: "root" @@ -597,9 +574,8 @@ downloads: containerd: enabled: "{{ container_manager == 'containerd' }}" file: true - version: "{{ containerd_version }}" dest: "{{ local_release_dir }}/containerd-{{ containerd_version }}-linux-{{ image_arch }}.tar.gz" - sha256: "{{ containerd_archive_checksum }}" + checksum: "{{ containerd_archive_checksum }}" url: "{{ containerd_download_url }}" unarchive: false owner: "root" @@ -610,9 +586,8 @@ downloads: gvisor_runsc: enabled: "{{ gvisor_enabled }}" file: true - version: "{{ gvisor_version }}" dest: "{{ local_release_dir }}/gvisor-runsc-{{ gvisor_version }}-{{ ansible_architecture }}" - sha256: "{{ gvisor_runsc_binary_checksum }}" + checksum: "{{ gvisor_runsc_binary_checksum }}" url: "{{ gvisor_runsc_download_url }}" unarchive: false owner: "root" @@ -623,9 +598,8 @@ downloads: gvisor_containerd_shim: enabled: "{{ gvisor_enabled }}" file: true - version: "{{ gvisor_version }}" dest: "{{ local_release_dir }}/gvisor-containerd-shim-runsc-v1-{{ gvisor_version }}-{{ ansible_architecture }}" - sha256: "{{ gvisor_containerd_shim_binary_checksum }}" + checksum: "{{ gvisor_containerd_shim_binary_checksum }}" url: "{{ gvisor_containerd_shim_runsc_download_url }}" unarchive: false owner: "root" @@ -636,9 +610,8 @@ downloads: nerdctl: file: true enabled: "{{ container_manager == 'containerd' }}" - version: "{{ nerdctl_version }}" dest: "{{ local_release_dir }}/nerdctl-{{ nerdctl_version }}-linux-{{ image_arch }}.tar.gz" - sha256: "{{ nerdctl_archive_checksum }}" + checksum: "{{ nerdctl_archive_checksum }}" url: "{{ nerdctl_download_url }}" unarchive: true owner: "root" @@ -649,9 +622,8 @@ downloads: skopeo: file: true enabled: "{{ container_manager == 'crio' }}" - version: "{{ skopeo_version }}" dest: "{{ local_release_dir }}/skopeo-{{ skopeo_version }}-{{ image_arch }}" - sha256: "{{ skopeo_binary_checksum }}" + checksum: "{{ skopeo_binary_checksum }}" url: "{{ skopeo_download_url }}" unarchive: false owner: "root" @@ -660,20 +632,20 @@ downloads: - kube_control_plane cilium: - enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool }}" + enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}" container: true repo: "{{ cilium_image_repo }}" tag: "{{ cilium_image_tag }}" - sha256: "{{ cilium_digest_checksum | default(None) }}" + checksum: "{{ cilium_digest_checksum | default(None) }}" groups: - k8s_cluster cilium_operator: - enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool }}" + enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}" container: true repo: "{{ cilium_operator_image_repo }}" tag: "{{ cilium_operator_image_tag }}" - sha256: "{{ cilium_operator_digest_checksum | default(None) }}" + checksum: "{{ cilium_operator_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -682,7 +654,7 @@ downloads: container: true repo: "{{ cilium_hubble_relay_image_repo }}" tag: "{{ cilium_hubble_relay_image_tag }}" - sha256: "{{ cilium_hubble_relay_digest_checksum | default(None) }}" + checksum: "{{ cilium_hubble_relay_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -691,7 +663,7 @@ downloads: container: true repo: "{{ cilium_hubble_certgen_image_repo }}" tag: "{{ cilium_hubble_certgen_image_tag }}" - sha256: "{{ cilium_hubble_certgen_digest_checksum | default(None) }}" + checksum: "{{ cilium_hubble_certgen_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -700,7 +672,7 @@ downloads: container: true repo: "{{ cilium_hubble_ui_image_repo }}" tag: "{{ cilium_hubble_ui_image_tag }}" - sha256: "{{ cilium_hubble_ui_digest_checksum | default(None) }}" + checksum: "{{ cilium_hubble_ui_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -709,7 +681,7 @@ downloads: container: true repo: "{{ cilium_hubble_ui_backend_image_repo }}" tag: "{{ cilium_hubble_ui_backend_image_tag }}" - sha256: "{{ cilium_hubble_ui_backend_digest_checksum | default(None) }}" + checksum: "{{ cilium_hubble_ui_backend_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -718,16 +690,15 @@ downloads: container: true repo: "{{ cilium_hubble_envoy_image_repo }}" tag: "{{ cilium_hubble_envoy_image_tag }}" - sha256: "{{ cilium_hubble_envoy_digest_checksum | default(None) }}" + checksum: "{{ cilium_hubble_envoy_digest_checksum | default(None) }}" groups: - k8s_cluster ciliumcli: - enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool }}" + enabled: "{{ kube_network_plugin == 'cilium' or cilium_deploy_additionally }}" file: true - version: "{{ cilium_cli_version }}" dest: "{{ local_release_dir }}/cilium-{{ cilium_cli_version }}-{{ image_arch }}.tar.gz" - sha256: "{{ ciliumcli_binary_checksum }}" + checksum: "{{ ciliumcli_binary_checksum }}" url: "{{ ciliumcli_download_url }}" unarchive: true owner: "root" @@ -740,7 +711,7 @@ downloads: container: true repo: "{{ multus_image_repo }}" tag: "{{ multus_image_tag }}" - sha256: "{{ multus_digest_checksum | default(None) }}" + checksum: "{{ multus_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -749,7 +720,7 @@ downloads: container: true repo: "{{ flannel_image_repo }}" tag: "{{ flannel_image_tag }}" - sha256: "{{ flannel_digest_checksum | default(None) }}" + checksum: "{{ flannel_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -758,16 +729,15 @@ downloads: container: true repo: "{{ flannel_init_image_repo }}" tag: "{{ flannel_init_image_tag }}" - sha256: "{{ flannel_init_digest_checksum | default(None) }}" + checksum: "{{ flannel_init_digest_checksum | default(None) }}" groups: - k8s_cluster calicoctl: enabled: "{{ kube_network_plugin == 'calico' }}" file: true - version: "{{ calico_ctl_version }}" dest: "{{ local_release_dir }}/calicoctl-{{ calico_ctl_version }}-{{ image_arch }}" - sha256: "{{ calicoctl_binary_checksum }}" + checksum: "{{ calicoctl_binary_checksum }}" url: "{{ calicoctl_download_url }}" unarchive: false owner: "root" @@ -780,7 +750,7 @@ downloads: container: true repo: "{{ calico_node_image_repo }}" tag: "{{ calico_node_image_tag }}" - sha256: "{{ calico_node_digest_checksum | default(None) }}" + checksum: "{{ calico_node_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -789,16 +759,7 @@ downloads: container: true repo: "{{ calico_cni_image_repo }}" tag: "{{ calico_cni_image_tag }}" - sha256: "{{ calico_cni_digest_checksum | default(None) }}" - groups: - - k8s_cluster - - calico_flexvol: - enabled: "{{ kube_network_plugin == 'calico' }}" - container: true - repo: "{{ calico_flexvol_image_repo }}" - tag: "{{ calico_flexvol_image_tag }}" - sha256: "{{ calico_flexvol_digest_checksum | default(None) }}" + checksum: "{{ calico_cni_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -807,7 +768,7 @@ downloads: container: true repo: "{{ calico_policy_image_repo }}" tag: "{{ calico_policy_image_tag }}" - sha256: "{{ calico_policy_digest_checksum | default(None) }}" + checksum: "{{ calico_policy_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -816,7 +777,7 @@ downloads: container: true repo: "{{ calico_typha_image_repo }}" tag: "{{ calico_typha_image_tag }}" - sha256: "{{ calico_typha_digest_checksum | default(None) }}" + checksum: "{{ calico_typha_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -825,22 +786,21 @@ downloads: container: true repo: "{{ calico_apiserver_image_repo }}" tag: "{{ calico_apiserver_image_tag }}" - sha256: "{{ calico_apiserver_digest_checksum | default(None) }}" + checksum: "{{ calico_apiserver_digest_checksum | default(None) }}" groups: - k8s_cluster calico_crds: file: true enabled: "{{ kube_network_plugin == 'calico' and calico_datastore == 'kdd' }}" - version: "{{ calico_version }}" dest: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ calico_version }}.tar.gz" - sha256: "{{ calico_crds_archive_checksum }}" + checksum: "{{ calico_crds_archive_checksums.no_arch[calico_version] }}" url: "{{ calico_crds_download_url }}" unarchive: true unarchive_extra_opts: - - "{{ '--strip=6' if (calico_version is version('v3.22.3', '<')) else '--strip=3' }}" + - "{{ '--strip=6' if (calico_version is version('3.22.3', '<')) else '--strip=3' }}" - "--wildcards" - - "{{ '*/_includes/charts/calico/crds/kdd/' if (calico_version is version('v3.22.3', '<')) else '*/libcalico-go/config/crd/' }}" + - "{{ '*/_includes/charts/calico/crds/kdd/' if (calico_version is version('3.22.3', '<')) else '*/libcalico-go/config/crd/' }}" owner: "root" mode: "0755" groups: @@ -851,7 +811,7 @@ downloads: container: true repo: "{{ weave_kube_image_repo }}" tag: "{{ weave_kube_image_tag }}" - sha256: "{{ weave_kube_digest_checksum | default(None) }}" + checksum: "{{ weave_kube_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -860,7 +820,7 @@ downloads: container: true repo: "{{ weave_npc_image_repo }}" tag: "{{ weave_npc_image_tag }}" - sha256: "{{ weave_npc_digest_checksum | default(None) }}" + checksum: "{{ weave_npc_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -869,7 +829,7 @@ downloads: container: true repo: "{{ kube_ovn_container_image_repo }}" tag: "{{ kube_ovn_container_image_tag }}" - sha256: "{{ kube_ovn_digest_checksum | default(None) }}" + checksum: "{{ kube_ovn_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -878,7 +838,7 @@ downloads: container: true repo: "{{ kube_router_image_repo }}" tag: "{{ kube_router_image_tag }}" - sha256: "{{ kube_router_digest_checksum | default(None) }}" + checksum: "{{ kube_router_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -887,7 +847,7 @@ downloads: container: true repo: "{{ pod_infra_image_repo }}" tag: "{{ pod_infra_image_tag }}" - sha256: "{{ pod_infra_digest_checksum | default(None) }}" + checksum: "{{ pod_infra_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -896,7 +856,7 @@ downloads: container: true repo: "{{ kube_vip_image_repo }}" tag: "{{ kube_vip_image_tag }}" - sha256: "{{ kube_vip_digest_checksum | default(None) }}" + checksum: "{{ kube_vip_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -905,7 +865,7 @@ downloads: container: true repo: "{{ nginx_image_repo }}" tag: "{{ nginx_image_tag }}" - sha256: "{{ nginx_digest_checksum | default(None) }}" + checksum: "{{ nginx_digest_checksum | default(None) }}" groups: - kube_node @@ -914,7 +874,7 @@ downloads: container: true repo: "{{ haproxy_image_repo }}" tag: "{{ haproxy_image_tag }}" - sha256: "{{ haproxy_digest_checksum | default(None) }}" + checksum: "{{ haproxy_digest_checksum | default(None) }}" groups: - kube_node @@ -923,7 +883,7 @@ downloads: container: true repo: "{{ coredns_image_repo }}" tag: "{{ coredns_image_tag }}" - sha256: "{{ coredns_digest_checksum | default(None) }}" + checksum: "{{ coredns_digest_checksum | default(None) }}" groups: - k8s_cluster @@ -932,25 +892,24 @@ downloads: container: true repo: "{{ nodelocaldns_image_repo }}" tag: "{{ nodelocaldns_image_tag }}" - sha256: "{{ nodelocaldns_digest_checksum | default(None) }}" + checksum: "{{ nodelocaldns_digest_checksum | default(None) }}" groups: - k8s_cluster dnsautoscaler: - enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] }}" + enabled: "{{ dns_mode in ['coredns', 'coredns_dual'] and enable_dns_autoscaler }}" container: true repo: "{{ dnsautoscaler_image_repo }}" tag: "{{ dnsautoscaler_image_tag }}" - sha256: "{{ dnsautoscaler_digest_checksum | default(None) }}" + checksum: "{{ dnsautoscaler_digest_checksum | default(None) }}" groups: - kube_control_plane helm: enabled: "{{ helm_enabled }}" file: true - version: "{{ helm_version }}" dest: "{{ local_release_dir }}/helm-{{ helm_version }}/helm-{{ helm_version }}-linux-{{ image_arch }}.tar.gz" - sha256: "{{ helm_archive_checksum }}" + checksum: "{{ helm_archive_checksum }}" url: "{{ helm_download_url }}" unarchive: true owner: "root" @@ -958,25 +917,12 @@ downloads: groups: - kube_control_plane - krew: - enabled: "{{ krew_enabled }}" - file: true - version: "{{ krew_version }}" - dest: "{{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }}.tar.gz" - sha256: "{{ krew_archive_checksum }}" - url: "{{ krew_download_url }}" - unarchive: true - owner: "root" - mode: "0755" - groups: - - kube_control_plane - registry: enabled: "{{ registry_enabled }}" container: true repo: "{{ registry_image_repo }}" tag: "{{ registry_image_tag }}" - sha256: "{{ registry_digest_checksum | default(None) }}" + checksum: "{{ registry_digest_checksum | default(None) }}" groups: - kube_node @@ -985,7 +931,7 @@ downloads: container: true repo: "{{ metrics_server_image_repo }}" tag: "{{ metrics_server_image_tag }}" - sha256: "{{ metrics_server_digest_checksum | default(None) }}" + checksum: "{{ metrics_server_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -994,25 +940,7 @@ downloads: container: true repo: "{{ local_volume_provisioner_image_repo }}" tag: "{{ local_volume_provisioner_image_tag }}" - sha256: "{{ local_volume_provisioner_digest_checksum | default(None) }}" - groups: - - kube_node - - cephfs_provisioner: - enabled: "{{ cephfs_provisioner_enabled }}" - container: true - repo: "{{ cephfs_provisioner_image_repo }}" - tag: "{{ cephfs_provisioner_image_tag }}" - sha256: "{{ cephfs_provisioner_digest_checksum | default(None) }}" - groups: - - kube_node - - rbd_provisioner: - enabled: "{{ rbd_provisioner_enabled }}" - container: true - repo: "{{ rbd_provisioner_image_repo }}" - tag: "{{ rbd_provisioner_image_tag }}" - sha256: "{{ rbd_provisioner_digest_checksum | default(None) }}" + checksum: "{{ local_volume_provisioner_digest_checksum | default(None) }}" groups: - kube_node @@ -1021,7 +949,7 @@ downloads: container: true repo: "{{ local_path_provisioner_image_repo }}" tag: "{{ local_path_provisioner_image_tag }}" - sha256: "{{ local_path_provisioner_digest_checksum | default(None) }}" + checksum: "{{ local_path_provisioner_digest_checksum | default(None) }}" groups: - kube_node @@ -1030,7 +958,7 @@ downloads: container: true repo: "{{ ingress_nginx_controller_image_repo }}" tag: "{{ ingress_nginx_controller_image_tag }}" - sha256: "{{ ingress_nginx_controller_digest_checksum | default(None) }}" + checksum: "{{ ingress_nginx_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -1039,7 +967,7 @@ downloads: container: true repo: "{{ alb_ingress_image_repo }}" tag: "{{ alb_ingress_image_tag }}" - sha256: "{{ ingress_alb_controller_digest_checksum | default(None) }}" + checksum: "{{ ingress_alb_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -1048,7 +976,7 @@ downloads: container: true repo: "{{ cert_manager_controller_image_repo }}" tag: "{{ cert_manager_controller_image_tag }}" - sha256: "{{ cert_manager_controller_digest_checksum | default(None) }}" + checksum: "{{ cert_manager_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -1057,7 +985,7 @@ downloads: container: true repo: "{{ cert_manager_cainjector_image_repo }}" tag: "{{ cert_manager_cainjector_image_tag }}" - sha256: "{{ cert_manager_cainjector_digest_checksum | default(None) }}" + checksum: "{{ cert_manager_cainjector_digest_checksum | default(None) }}" groups: - kube_node @@ -1066,16 +994,28 @@ downloads: container: true repo: "{{ cert_manager_webhook_image_repo }}" tag: "{{ cert_manager_webhook_image_tag }}" - sha256: "{{ cert_manager_webhook_digest_checksum | default(None) }}" + checksum: "{{ cert_manager_webhook_digest_checksum | default(None) }}" groups: - kube_node + gateway_api_crds: + enabled: "{{ gateway_api_enabled }}" + file: true + version: "{{ gateway_api_version }}" + dest: "{{ local_release_dir }}/gateway-api-{{ gateway_api_channel }}-install.yaml" + checksum: "{{ lookup('vars', 'gateway_api_' + gateway_api_channel + '_crds_checksums').no_arch[gateway_api_version] }}" + url: "{{ gateway_api_crds_download_url }}" + owner: "root" + mode: "0755" + groups: + - kube_control_plane + csi_attacher: enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}" container: true repo: "{{ csi_attacher_image_repo }}" tag: "{{ csi_attacher_image_tag }}" - sha256: "{{ csi_attacher_digest_checksum | default(None) }}" + checksum: "{{ csi_attacher_digest_checksum | default(None) }}" groups: - kube_node @@ -1084,7 +1024,7 @@ downloads: container: true repo: "{{ csi_provisioner_image_repo }}" tag: "{{ csi_provisioner_image_tag }}" - sha256: "{{ csi_provisioner_digest_checksum | default(None) }}" + checksum: "{{ csi_provisioner_digest_checksum | default(None) }}" groups: - kube_node @@ -1093,7 +1033,7 @@ downloads: container: true repo: "{{ csi_snapshotter_image_repo }}" tag: "{{ csi_snapshotter_image_tag }}" - sha256: "{{ csi_snapshotter_digest_checksum | default(None) }}" + checksum: "{{ csi_snapshotter_digest_checksum | default(None) }}" groups: - kube_node @@ -1102,7 +1042,7 @@ downloads: container: true repo: "{{ snapshot_controller_image_repo }}" tag: "{{ snapshot_controller_image_tag }}" - sha256: "{{ snapshot_controller_digest_checksum | default(None) }}" + checksum: "{{ snapshot_controller_digest_checksum | default(None) }}" groups: - kube_node @@ -1111,7 +1051,7 @@ downloads: container: true repo: "{{ csi_resizer_image_repo }}" tag: "{{ csi_resizer_image_tag }}" - sha256: "{{ csi_resizer_digest_checksum | default(None) }}" + checksum: "{{ csi_resizer_digest_checksum | default(None) }}" groups: - kube_node @@ -1120,7 +1060,7 @@ downloads: container: true repo: "{{ csi_node_driver_registrar_image_repo }}" tag: "{{ csi_node_driver_registrar_image_tag }}" - sha256: "{{ csi_node_driver_registrar_digest_checksum | default(None) }}" + checksum: "{{ csi_node_driver_registrar_digest_checksum | default(None) }}" groups: - kube_node @@ -1129,7 +1069,7 @@ downloads: container: true repo: "{{ cinder_csi_plugin_image_repo }}" tag: "{{ cinder_csi_plugin_image_tag }}" - sha256: "{{ cinder_csi_plugin_digest_checksum | default(None) }}" + checksum: "{{ cinder_csi_plugin_digest_checksum | default(None) }}" groups: - kube_node @@ -1138,7 +1078,7 @@ downloads: container: true repo: "{{ aws_ebs_csi_plugin_image_repo }}" tag: "{{ aws_ebs_csi_plugin_image_tag }}" - sha256: "{{ aws_ebs_csi_plugin_digest_checksum | default(None) }}" + checksum: "{{ aws_ebs_csi_plugin_digest_checksum | default(None) }}" groups: - kube_node @@ -1147,7 +1087,7 @@ downloads: container: true repo: "{{ dashboard_image_repo }}" tag: "{{ dashboard_image_tag }}" - sha256: "{{ dashboard_digest_checksum | default(None) }}" + checksum: "{{ dashboard_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -1156,7 +1096,7 @@ downloads: container: true repo: "{{ dashboard_metrics_scraper_repo }}" tag: "{{ dashboard_metrics_scraper_tag }}" - sha256: "{{ dashboard_digest_checksum | default(None) }}" + checksum: "{{ dashboard_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -1164,8 +1104,8 @@ downloads: enabled: "{{ metallb_speaker_enabled }}" container: true repo: "{{ metallb_speaker_image_repo }}" - tag: "{{ metallb_version }}" - sha256: "{{ metallb_speaker_digest_checksum | default(None) }}" + tag: "{{ metallb_image_tag }}" + checksum: "{{ metallb_speaker_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -1173,8 +1113,8 @@ downloads: enabled: "{{ metallb_enabled }}" container: true repo: "{{ metallb_controller_image_repo }}" - tag: "{{ metallb_version }}" - sha256: "{{ metallb_controller_digest_checksum | default(None) }}" + tag: "{{ metallb_image_tag }}" + checksum: "{{ metallb_controller_digest_checksum | default(None) }}" groups: - kube_control_plane @@ -1183,7 +1123,7 @@ downloads: file: true version: "{{ yq_version }}" dest: "{{ local_release_dir }}/yq-{{ yq_version }}-{{ image_arch }}" - sha256: "{{ yq_binary_checksum | default(None) }}" + checksum: "{{ yq_binary_checksum }}" url: "{{ yq_download_url }}" unarchive: false owner: "root" @@ -1198,7 +1138,6 @@ download_defaults: tag: None enabled: false dest: None - version: None url: None unarchive: false owner: "{{ kube_owner }}" diff --git a/kubespray/project/roles/kubespray-defaults/defaults/main/main.yml b/kubespray/project/roles/kubespray_defaults/defaults/main/main.yml similarity index 70% rename from kubespray/project/roles/kubespray-defaults/defaults/main/main.yml rename to kubespray/project/roles/kubespray_defaults/defaults/main/main.yml index 4f1dfd2..1c2039c 100644 --- a/kubespray/project/roles/kubespray-defaults/defaults/main/main.yml +++ b/kubespray/project/roles/kubespray_defaults/defaults/main/main.yml @@ -6,6 +6,9 @@ ansible_ssh_common_args: "{% if 'bastion' in groups['all'] %} -o ProxyCommand='s # selinux state preinstall_selinux_state: permissive +# Check if access_ip responds to ping. Set false if your firewall blocks ICMP. +ping_access_ip: true + # Setting this value to false will fail # For details, read this comment https://github.com/kubernetes-sigs/kubespray/pull/11016#issuecomment-2004985001 kube_api_anonymous_auth: true @@ -18,17 +21,28 @@ kubelet_fail_swap_on: true kubelet_swap_behavior: LimitedSwap ## Change this to use another Kubernetes version, e.g. a current beta release -kube_version: v1.30.4 +kube_version: "{{ (kubelet_checksums['amd64'] | dict2items)[0].key }}" ## The minimum version working -kube_version_min_required: v1.28.0 +kube_version_min_required: "{{ (kubelet_checksums['amd64'] | dict2items)[-1].key }}" ## Kube Proxy mode One of ['iptables', 'ipvs'] kube_proxy_mode: ipvs +# Kubeadm config api version +# If kube_version is v1.31 or higher, it will be v1beta4, otherwise it will be v1beta3. +kubeadm_config_api_version: "{{ 'v1beta4' if kube_version is version('1.31.0', '>=') else 'v1beta3' }}" + +# Debugging option for the kubeadm config validate command +# Set to false only for development and testing scenarios where validation is expected to fail (pre-release Kubernetes versions, etc.) +kubeadm_config_validate_enabled: true + ## The timeout for init first control-plane kubeadm_init_timeout: 300s +# TODO: remove this +kube_reserved_cgroups_for_service_slice: kube.slice + ## List of kubeadm init phases that should be skipped during control plane setup ## By default 'addon/coredns' is skipped ## 'addon/kube-proxy' gets skipped for some network plugins @@ -36,7 +50,7 @@ kubeadm_init_phases_skip_default: [ "addon/coredns" ] kubeadm_init_phases_skip: >- {%- if kube_network_plugin == 'kube-router' and (kube_router_run_service_proxy is defined and kube_router_run_service_proxy) -%} {{ kubeadm_init_phases_skip_default + ["addon/kube-proxy"] }} - {%- elif kube_network_plugin == 'cilium' and (cilium_kube_proxy_replacement is defined and cilium_kube_proxy_replacement == 'strict') -%} + {%- elif kube_network_plugin == 'cilium' and (cilium_kube_proxy_replacement is defined and (cilium_kube_proxy_replacement == 'strict' or (cilium_kube_proxy_replacement | bool) or (cilium_kube_proxy_replacement | string | lower == 'true') )) -%} {{ kubeadm_init_phases_skip_default + ["addon/kube-proxy"] }} {%- elif kube_network_plugin == 'calico' and (calico_bpf_enabled is defined and calico_bpf_enabled) -%} {{ kubeadm_init_phases_skip_default + ["addon/kube-proxy"] }} @@ -69,7 +83,9 @@ kube_proxy_nodeport_addresses: >- # Set to true to allow pre-checks to fail and continue deployment ignore_assert_errors: false +# kube-vip kube_vip_enabled: false +kube_vip_lb_fwdmethod: local # nginx-proxy configure nginx_config_dir: "/etc/nginx" @@ -88,9 +104,6 @@ local_release_dir: "/tmp/releases" # Random shifts for retrying failed ops like pushing/downloading retry_stagger: 5 -# Install epel repo on Centos/RHEL -epel_enabled: false - # DNS configuration. # Kubernetes cluster name, also will be used as DNS domain cluster_name: cluster.local @@ -107,6 +120,10 @@ dns_mode: coredns # Enable dns autoscaler enable_dns_autoscaler: true +# DNS servers added after the cluster DNS +# These will also be used as upstream by Coredns for out-cluster queries +upstream_dns_servers: [] + # Enable nodelocal dns cache enable_nodelocaldns: true enable_nodelocaldns_secondary: false @@ -124,12 +141,13 @@ resolvconf_mode: host_resolvconf # Deploy netchecker app to verify DNS resolve as an HTTP service deploy_netchecker: false # Ip address of the kubernetes DNS service (called skydns for historical reasons) -skydns_server: "{{ kube_service_addresses | ansible.utils.ipaddr('net') | ansible.utils.ipaddr(3) | ansible.utils.ipaddr('address') }}" -skydns_server_secondary: "{{ kube_service_addresses | ansible.utils.ipaddr('net') | ansible.utils.ipaddr(4) | ansible.utils.ipaddr('address') }}" +skydns_server: "{{ kube_service_subnets.split(',') | first | ansible.utils.ipaddr('net') | ansible.utils.ipaddr(3) | ansible.utils.ipaddr('address') }}" +skydns_server_secondary: "{{ kube_service_subnets.split(',') | first | ansible.utils.ipaddr('net') | ansible.utils.ipaddr(4) | ansible.utils.ipaddr('address') }}" dns_domain: "{{ cluster_name }}" docker_dns_search_domains: - 'default.svc.{{ dns_domain }}' - 'svc.{{ dns_domain }}' +searchdomains: [] kube_dns_servers: coredns: ["{{ skydns_server }}"] @@ -186,6 +204,12 @@ kube_log_level: 2 kube_network_plugin: calico kube_network_plugin_multus: false +## Network plugin options with dependencies across the whole playbook + +# Deploy cilium even if kube_network_plugin is not cilium. +# This enables to deploy cilium alongside another CNI to replace kube-proxy. +cilium_deploy_additionally: false + # Determines if calico_rr group exists peer_with_calico_rr: "{{ 'calico_rr' in groups and groups['calico_rr'] | length > 0 }}" @@ -218,43 +242,45 @@ kube_pods_subnet: 10.233.64.0/18 kube_network_node_prefix: 24 # Configure Dual Stack networking (i.e. both IPv4 and IPv6) -enable_dual_stack_networks: false +# enable_dual_stack_networks: false # deprecated + +# Configure IPv4 Stack networking +ipv4_stack: true +# Configure IPv6 Stack networking +ipv6_stack: "{{ enable_dual_stack_networks | default(false) }}" # Kubernetes internal network for IPv6 services, unused block of space. -# This is only used if enable_dual_stack_networks is set to true +# This is only used if ipv6_stack is set to true # This provides 4096 IPv6 IPs kube_service_addresses_ipv6: fd85:ee78:d8a6:8607::1000/116 # Internal network. When used, it will assign IPv6 addresses from this range to individual pods. # This network must not already be in your network infrastructure! -# This is only used if enable_dual_stack_networks is set to true. +# This is only used if ipv6_stack is set to true. # This provides room for 256 nodes with 254 pods per node. kube_pods_subnet_ipv6: fd85:ee78:d8a6:8607::1:0000/112 # IPv6 subnet size allocated to each for pods. -# This is only used if enable_dual_stack_networks is set to true +# This is only used if ipv6_stack is set to true # This provides room for 254 pods per node. kube_network_node_prefix_ipv6: 120 + # The virtual cluster IP, real host IPs and ports the API Server will be # listening on. # NOTE: loadbalancer_apiserver_localhost somewhat alters the final API enpdoint # access IP value (automatically evaluated below) -kube_apiserver_ip: "{{ kube_service_addresses | ansible.utils.ipaddr('net') | ansible.utils.ipaddr(1) | ansible.utils.ipaddr('address') }}" +kube_apiserver_ip: "{{ kube_service_subnets.split(',') | first | ansible.utils.ipaddr('net') | ansible.utils.ipaddr(1) | ansible.utils.ipaddr('address') }}" # NOTE: If you specific address/interface and use loadbalancer_apiserver_localhost -# loadbalancer_apiserver_localhost (nginx/haproxy) will deploy on masters on 127.0.0.1:{{ loadbalancer_apiserver_port | default(kube_apiserver_port) }} too. -kube_apiserver_bind_address: 0.0.0.0 +# loadbalancer_apiserver_localhost (nginx/haproxy) will deploy on control plane nodes on 127.0.0.1:{{ loadbalancer_apiserver_port | default(kube_apiserver_port) }} too. +kube_apiserver_bind_address: "::" # https kube_apiserver_port: 6443 # If non-empty, will use this string as identification instead of the actual hostname -kube_override_hostname: >- - {%- if cloud_provider is defined and cloud_provider in ['aws'] -%} - {%- else -%} - {{ inventory_hostname }} - {%- endif -%} +kube_override_hostname: "{{ inventory_hostname }}" # define kubelet config dir for dynamic kubelet # kubelet_config_dir: @@ -272,15 +298,24 @@ kubelet_shutdown_grace_period: 60s # to give normal pods time to be gracefully evacuated kubelet_shutdown_grace_period_critical_pods: 20s +# Cloud Provider +# This variable can only be set to "external" or empty string, otherwise the check will fail. +cloud_provider: "" +# External Cloud Controller Manager (Formerly known as cloud provider) +# cloud_provider must be "external", otherwise this setting is invalid. +# Supported external cloud controllers are: 'openstack', 'vsphere', 'oci', 'huaweicloud', 'hcloud' and 'manual' +# 'manual' does not install the cloud controller manager used by Kubespray. +# If you fill in a value other than the above, the check will fail. +external_cloud_provider: "" + # Whether to deploy the container engine -deploy_container_engine: "{{ inventory_hostname in groups['k8s_cluster'] or etcd_deployment_type == 'docker' }}" +deploy_container_engine: "{{ 'k8s_cluster' in group_names or etcd_deployment_type == 'docker' }}" # Container for runtime container_manager: containerd -# Enable Node Resource Interface in containerd or CRI-O. Requires crio_version >= v1.26.0 -# or containerd_version >= 1.7.0. -nri_enabled: false +# Enable Node Resource Interface plugin for containerd +nri_enabled: "{{ container_manager == 'containerd' }}" # Enable Kata Containers as additional container runtime # When enabled, it requires `container_manager` different than Docker @@ -290,6 +325,10 @@ kata_containers_enabled: false # gVisor is only supported with container_manager Docker or containerd gvisor_enabled: false +# Enable runc as additional container runtime +# When enabled, it requires container_manager=crio +runc_enabled: false + # Enable crun as additional container runtime # When enabled, it requires container_manager=crio crun_enabled: false @@ -389,7 +428,6 @@ dashboard_enabled: false # Addons which can be enabled helm_enabled: false -krew_enabled: false registry_enabled: false metrics_server_enabled: false enable_network_policy: true @@ -404,8 +442,6 @@ vsphere_csi_enabled: false upcloud_csi_enabled: false csi_snapshot_controller_enabled: false persistent_volumes_enabled: false -cephfs_provisioner_enabled: false -rbd_provisioner_enabled: false ingress_nginx_enabled: false ingress_alb_enabled: false cert_manager_enabled: false @@ -413,6 +449,7 @@ expand_persistent_volumes: false metallb_enabled: false metallb_speaker_enabled: "{{ metallb_enabled }}" argocd_enabled: false +gateway_api_enabled: false ## When OpenStack is used, Cinder version can be explicitly specified if autodetection fails (Fixed in 1.9: https://github.com/kubernetes/kubernetes/issues/50461) # openstack_blockstorage_version: "v1/v2/auto (default)" @@ -466,7 +503,63 @@ external_hcloud_cloud: ## the k8s cluster. Only 'AlwaysAllow', 'AlwaysDeny', 'Node' and ## 'RBAC' modes are tested. Order is important. authorization_modes: ['Node', 'RBAC'] -rbac_enabled: "{{ 'RBAC' in authorization_modes }}" + +## Structured authorization config +## Structured AuthorizationConfiguration is a new feature in Kubernetes v1.29+ (GA in v1.32) that configures the API server's authorization modes with a structured configuration file. +## AuthorizationConfiguration files offer features not available with the `--authorization-mode` flag, although Kubespray supports both methods and authorization-mode remains the default for now. +## Note: Because the `--authorization-config` and `--authorization-mode` flags are mutually exclusive, the `authorization_modes` ansible variable is ignored when `kube_apiserver_use_authorization_config_file` is set to true. The two features cannot be used at the same time. +## Docs: https://kubernetes.io/docs/reference/access-authn-authz/authorization/#configuring-the-api-server-using-an-authorization-config-file +## Examples: https://kubernetes.io/blog/2024/04/26/multi-webhook-and-modular-authorization-made-much-easier/ +## KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3221-structured-authorization-configuration +kube_apiserver_use_authorization_config_file: false +kube_apiserver_authorization_config_api_version: "{{ 'v1alpha1' if kube_version is version('1.30.0', '<') else 'v1beta1' if kube_version is version('1.32.0', '<') else 'v1' }}" +kube_apiserver_authorization_config_authorizers: +- type: Node + name: node +- type: RBAC + name: rbac +## Example for use with kube_webhook_authorization: true +# - type: Webhook +# name: webhook +# webhook: +# connectionInfo: +# type: KubeConfigFile +# kubeConfigFile: "{{ kube_config_dir }}/webhook-authorization-config.yaml" +# subjectAccessReviewVersion: v1beta1 +# matchConditionSubjectAccessReviewVersion: v1 +# timeout: 3s +# failurePolicy: NoOpinion +# matchConditions: +# # Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ +# # only send resource requests to the webhook +# - expression: has(request.resourceAttributes) +# # Don't intercept requests from kube-system service accounts +# - expression: "!('system:serviceaccounts:kube-system' in request.groups)" +# ## Below expressions avoid issues with kubeadm init and other system components that should be authorized by Node and RBAC +# # Don't process node and bootstrap token requests with the webhook +# - expression: "!('system:nodes' in request.groups)" +# - expression: "!('system:bootstrappers' in request.groups)" +# - expression: "!('system:bootstrappers:kubeadm:default-node-token' in request.groups)" +# # Don't process kubeadm requests with the webhook +# - expression: "!('kubeadm:cluster-admins' in request.groups)" +# - expression: "!('system:masters' in request.groups)" + +## Two workarounds are required to use AuthorizationConfiguration with kubeadm v1.29.x: +## 1. Enable the StructuredAuthorizationConfiguration feature gate: +# kube_apiserver_feature_gates: +# - StructuredAuthorizationConfiguration=true +## 2. Use the following kubeadm_patches to remove defaulted authorization-mode flags (Workaround for a kubeadm defaulting bug on v1.29.x. fixed in 1.30+ via: https://github.com/kubernetes/kubernetes/pull/123654) +# kubeadm_patches: +# - target: kube-apiserver +# type: strategic +# patch: +# spec: +# containers: +# - name: kube-apiserver +# $deleteFromPrimitiveList/command: +# - --authorization-mode=Node,RBAC + +rbac_enabled: "{{ ('RBAC' in authorization_modes and not kube_apiserver_use_authorization_config_file) or (kube_apiserver_use_authorization_config_file and kube_apiserver_authorization_config_authorizers | selectattr('type', 'equalto', 'RBAC') | list | length > 0) }}" # When enabled, API bearer tokens (including service account tokens) can be used to authenticate to the kubelet's HTTPS endpoint kubelet_authentication_token_webhook: true @@ -531,11 +624,10 @@ ssl_ca_dirs: |- ] # Vars for pointing to kubernetes api endpoints -is_kube_master: "{{ inventory_hostname in groups['kube_control_plane'] }}" kube_apiserver_count: "{{ groups['kube_control_plane'] | length }}" -kube_apiserver_address: "{{ ip | default(fallback_ips[inventory_hostname]) }}" -kube_apiserver_access_address: "{{ access_ip | default(kube_apiserver_address) }}" -first_kube_control_plane_address: "{{ hostvars[groups['kube_control_plane'][0]]['access_ip'] | default(hostvars[groups['kube_control_plane'][0]]['ip'] | default(fallback_ips[groups['kube_control_plane'][0]])) }}" +kube_apiserver_address: "{{ hostvars[inventory_hostname]['main_ip'] }}" +kube_apiserver_access_address: "{{ hostvars[inventory_hostname]['main_access_ip'] }}" +first_kube_control_plane_address: "{{ hostvars[groups['kube_control_plane'][0]]['main_access_ip'] }}" loadbalancer_apiserver_localhost: "{{ loadbalancer_apiserver is not defined }}" loadbalancer_apiserver_type: "nginx" # applied if only external loadbalancer_apiserver is defined, otherwise ignored @@ -546,17 +638,17 @@ kube_apiserver_global_endpoint: |- {%- elif loadbalancer_apiserver_localhost and (loadbalancer_apiserver_port is not defined or loadbalancer_apiserver_port == kube_apiserver_port) -%} https://localhost:{{ kube_apiserver_port }} {%- else -%} - https://{{ first_kube_control_plane_address }}:{{ kube_apiserver_port }} + https://{{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} {%- endif %} kube_apiserver_endpoint: |- {% if loadbalancer_apiserver is defined -%} https://{{ apiserver_loadbalancer_domain_name }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }} - {%- elif not is_kube_master and loadbalancer_apiserver_localhost -%} + {%- elif ('kube_control_plane' not in group_names) and loadbalancer_apiserver_localhost -%} https://localhost:{{ loadbalancer_apiserver_port | default(kube_apiserver_port) }} - {%- elif is_kube_master -%} - https://{{ kube_apiserver_bind_address | regex_replace('0\.0\.0\.0', '127.0.0.1') }}:{{ kube_apiserver_port }} + {%- elif 'kube_control_plane' in group_names -%} + https://{{ kube_apiserver_bind_address | regex_replace('::', '127.0.0.1') | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} {%- else -%} - https://{{ first_kube_control_plane_address }}:{{ kube_apiserver_port }} + https://{{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} {%- endif %} kube_apiserver_client_cert: "{{ kube_cert_dir }}/ca.crt" kube_apiserver_client_key: "{{ kube_cert_dir }}/ca.key" @@ -568,47 +660,46 @@ etcd_events_cluster_enabled: false etcd_hosts: "{{ groups['etcd'] | default(groups['kube_control_plane']) }}" # Vars for pointing to etcd endpoints -is_etcd_master: "{{ inventory_hostname in groups['etcd'] }}" -etcd_address: "{{ ip | default(fallback_ips[inventory_hostname]) }}" -etcd_access_address: "{{ access_ip | default(etcd_address) }}" -etcd_events_access_address: "{{ access_ip | default(etcd_address) }}" -etcd_peer_url: "https://{{ etcd_access_address }}:2380" -etcd_client_url: "https://{{ etcd_access_address }}:2379" -etcd_events_peer_url: "https://{{ etcd_events_access_address }}:2382" -etcd_events_client_url: "https://{{ etcd_events_access_address }}:2383" +etcd_address: "{{ hostvars[inventory_hostname]['main_ip'] }}" +etcd_access_address: "{{ hostvars[inventory_hostname]['main_access_ip'] }}" +etcd_events_access_address: "{{ hostvars[inventory_hostname]['main_access_ip'] }}" +etcd_peer_url: "https://{{ etcd_access_address | ansible.utils.ipwrap }}:2380" +etcd_client_url: "https://{{ etcd_access_address | ansible.utils.ipwrap }}:2379" +etcd_events_peer_url: "https://{{ etcd_events_access_address | ansible.utils.ipwrap }}:2382" +etcd_events_client_url: "https://{{ etcd_events_access_address | ansible.utils.ipwrap }}:2383" etcd_access_addresses: |- {% for item in etcd_hosts -%} - https://{{ hostvars[item]['etcd_access_address'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}:2379{% if not loop.last %},{% endif %} + https://{{ hostvars[item]['main_access_ip'] | ansible.utils.ipwrap }}:2379{% if not loop.last %},{% endif %} {%- endfor %} etcd_events_access_addresses_list: |- [ {% for item in etcd_hosts -%} - 'https://{{ hostvars[item]['etcd_events_access_address'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}:2383'{% if not loop.last %},{% endif %} + 'https://{{ hostvars[item].main_access_ip | ansible.utils.ipwrap }}:2383'{% if not loop.last %},{% endif %} {%- endfor %} ] etcd_metrics_addresses: |- {% for item in etcd_hosts -%} - https://{{ hostvars[item]['etcd_access_address'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}:{{ etcd_metrics_port | default(2381) }}{% if not loop.last %},{% endif %} + https://{{ hostvars[item]['main_access_ip'] | ansible.utils.ipwrap }}:{{ etcd_metrics_port | default(2381) }}{% if not loop.last %},{% endif %} {%- endfor %} etcd_events_access_addresses: "{{ etcd_events_access_addresses_list | join(',') }}" etcd_events_access_addresses_semicolon: "{{ etcd_events_access_addresses_list | join(';') }}" # user should set etcd_member_name in inventory/mycluster/hosts.ini etcd_member_name: |- {% for host in groups['etcd'] %} - {% if inventory_hostname == host %}{{ hostvars[host].etcd_member_name | default("etcd" + loop.index | string) }}{% endif %} + {% if inventory_hostname == host %}{{ hostvars[host].etcd_member_name | default("etcd" + loop.index | string) }}{% endif %} {% endfor %} etcd_peer_addresses: |- {% for item in groups['etcd'] -%} - {{ hostvars[item].etcd_member_name | default("etcd" + loop.index | string) }}=https://{{ hostvars[item].etcd_access_address | default(hostvars[item].ip | default(fallback_ips[item])) }}:2380{% if not loop.last %},{% endif %} + {{ hostvars[item].etcd_member_name | default("etcd" + loop.index | string) }}=https://{{ hostvars[item]['main_access_ip'] | ansible.utils.ipwrap }}:2380{% if not loop.last %},{% endif %} {%- endfor %} etcd_events_peer_addresses: |- {% for item in groups['etcd'] -%} - {{ hostvars[item].etcd_member_name | default("etcd" + loop.index | string) }}-events=https://{{ hostvars[item].etcd_events_access_address | default(hostvars[item].ip | default(fallback_ips[item])) }}:2382{% if not loop.last %},{% endif %} + {{ hostvars[item].etcd_member_name | default("etcd" + loop.index | string) }}-events=https://{{ hostvars[item]['main_access_ip'] | ansible.utils.ipwrap }}:2382{% if not loop.last %},{% endif %} {%- endfor %} etcd_heartbeat_interval: "250" etcd_election_timeout: "5000" -etcd_snapshot_count: "10000" +etcd_snapshot_count: "100000" certificates_key_size: 2048 certificates_duration: 36500 @@ -671,9 +762,6 @@ proxy_disable_env: https_proxy: '' no_proxy: '' -# krew root dir -krew_root_dir: "/usr/local/krew" - # sysctl_file_path to add sysctl conf to sysctl_file_path: "/etc/sysctl.d/99-sysctl.conf" @@ -682,3 +770,20 @@ system_upgrade_reboot: on-upgrade # never, always # Enables or disables the scheduler plugins. scheduler_plugins_enabled: false + +## NTP Settings +# Start the ntpd or chrony service and enable it at system boot. +ntp_enabled: false + +# TODO: Refactor NTP package selection to integrate with the general package installation system +# instead of using a separate variable approach + +# The package to install which provides NTP functionality. +# The default is ntp for most platforms, or chrony on RHEL/CentOS 7 and later. +# The ntp_package can be one of ['ntp', 'ntpsec', 'chrony'] +ntp_package: >- + {% if ansible_os_family == "RedHat" -%} + chrony + {%- else -%} + ntp + {%- endif -%} diff --git a/kubespray/project/roles/kubespray_defaults/vars/main/checksums.yml b/kubespray/project/roles/kubespray_defaults/vars/main/checksums.yml new file mode 100644 index 0000000..fdb430a --- /dev/null +++ b/kubespray/project/roles/kubespray_defaults/vars/main/checksums.yml @@ -0,0 +1,1358 @@ +--- +crictl_checksums: + arm64: + 1.32.0: sha256:f2f4e20658b72d00897f41e4b57093c8080e2d800ee894a5f4351f31d1833e30 + 1.31.1: sha256:cd70f9b2f75c9619f40450d4b6e2c74aaab619917da517eff6787b442f8b0e56 + 1.31.0: sha256:f9879541e92fd302db00b9d28ef617744bb8b8b62520bd4c0479819d7d4ae869 + 1.30.1: sha256:61da7c11926fd29b27e191c3c25d64f2cb51d39dff72a7c90c1fbbc8d5c70f85 + 1.30.0: sha256:3769043fc6018a9e1697fcb768bb89ecd429176bd71e849058916f79a46a07a8 + amd64: + 1.32.0: sha256:f050b71d3a73a91a4e0990b90143ed04dcd100cc66f953736fcb6a2730e283c4 + 1.31.1: sha256:0a03ba6b1e4c253d63627f8d210b2ea07675a8712587e697657b236d06d7d231 + 1.31.0: sha256:9daa32308090aedee5a7f2ab1f1428fef6f669a64e993f0b5b98db8ef6edd71b + 1.30.1: sha256:71873cdeeeb6c9ee0f79c27b45db38066da81f0c30dcda909b4eedc3aff63f59 + 1.30.0: sha256:3dd03954565808eaeb3a7ffc0e8cb7886a64a9aa94b2bfdfbdc6e2ed94842e49 + ppc64le: + 1.32.0: sha256:4ffaf29bbda8df42ed2dda4f1ad33cc785987701dc8d1e0043c17cfea9af43e0 + 1.31.1: sha256:8a9f39335601ae3a749d90287a3f0980de01366748b83c0b067c0bf05228ad7d + 1.31.0: sha256:ed545379a61deff415172ea3ca6b847166c5d116c7a1271866286cd0242c09a2 + 1.30.1: sha256:bafdeb709f714619c1f91579d485f46b44f1bbce2dc94227a3db761fbeb58664 + 1.30.0: sha256:ada550cecb5647014f16dd3ff6c59d7ef7d942ca8cb6c51c15ed019622f39ee9 +crio_archive_checksums: + arm64: + 1.32.4: sha256:06ccee8b31963f80c0253bf8c6ba56afa222fc0608ca309b21ace2d8748e3023 + 1.32.3: sha256:f196bdc30c8effbbc8ec54f99e2598e34a901a7996a2f8a53f1f9134b0dc1b80 + 1.32.2: sha256:627df634df178baf2800c8eb68185489e82f78b0b33ea5bec2bf9ce55ad57647 + 1.32.1: sha256:f64da0ef41604575b476ad6d7288ca14f56fc06cc0ca138a5c3dc933427f7b32 + 1.32.0: sha256:b092eddabedac98a0f8449dc535acfec0e14c21f59cabe8f9703043d995a1a41 + 1.31.8: sha256:a6fd3bf8f9d40d51ad806be7246d3d38682cb2071af428404300098ca086afcf + 1.31.7: sha256:66c4beb5e331881bec173baf5945b7c1da78fd56479e79b35185c63b05fcd03e + 1.31.6: sha256:1a7baa55c495ea2d89d5c27d9ee1b4c1f251e4dba2c0e71c75c2a194cd733081 + 1.31.5: sha256:8b00fe37779cb7bf4716c600c25bffff3fd175c88e0938e4dc56409791040459 + 1.31.4: sha256:9b8c89a13c56449acc7b97d06179c1d2cc7276023406fb70d477e1237e5644f2 + 1.31.3: sha256:150e828420848d7dc4d190c13b313c7033f9a255a6e656e32b98f27ac574daa0 + 1.31.2: sha256:ba0e71699aa7a0e995ac2563b8aee2f2a3358ac120edb8b951e151824f16d5a4 + 1.31.1: sha256:760d00cecaf1b6bf5a3bfae39daa5e46a74408f7a6869cbb41716a5610a7a18f + 1.31.0: sha256:d54afe0140afde0bed09136bd923d8fb415c9016189e7f1b719565ec84edf737 + 1.30.13: sha256:f9eda79e902660e8dd53231d533e6f4f0feaa6a3fc1b15bb30b8f17e8d9bf93c + 1.30.12: sha256:689084fb694b841eedf2ee0d03024d7b245d87f3119b2eab123dcd6d562ca0cd + 1.30.11: sha256:89e5ec8b441303b08dd18edabf3607564823a62451b2312049e24a38d1f7644c + 1.30.10: sha256:2e93a1ee31b3cdeebbd05cf342dcfab5f35a3a654a25ea47963daf185cdf792a + 1.30.9: sha256:1d565518cada3d767d87b69b8831384e1f51cbb4909c1a58777b133d954bbe05 + 1.30.8: sha256:8a1ab4b2589991cba6950a13985aec8d8f4adb16f2d2ed29d9d0e3022e964d12 + 1.30.7: sha256:5227aad37976a554b8195e99f07fa23d5b4b7abea61f85efcf68ebe8bfd63675 + 1.30.6: sha256:24183ad2e5b496d8f55c0c9d8dcc960a3ce708105b54e88c0b7789dba7024e67 + 1.30.5: sha256:61354b4d0d5e4564ef36c92fe4dfef3d38cb1839dcf4987ce52fcd78032dcd0f + 1.30.4: sha256:073be5d718657719fee993af005f9b897ecb209e61e3828a8e74c74314b7d8c6 + 1.30.3: sha256:2e47b4b307788b15263256e0e423574c60eec80e17576704df736a7ccc13d7bd + 1.30.2: sha256:6c0ed1a8a38c65fda45d8b725b8742d247e9f658d8cd6c56baa05bd749b9ccbe + 1.30.1: sha256:371a6da24dfc7c9e01f29191b36a0629474a37cd8300fa8a36483647a7859b72 + 1.30.0: sha256:7e7c934cebff6433594e4cdc440e1ceb5602741a35d74b2342dac6fb585c3549 + amd64: + 1.32.4: sha256:9934370708bfc641649bef83cd8df0745e8d3a3887b67062ae970d95b58003f4 + 1.32.3: sha256:860c53b91dbe547b0cf23837880506a92348783efd9a7003a7da3fff6555fa28 + 1.32.2: sha256:3ab6b4cc7641c2d181c2141ca42edecaac837d1409caef9311ebc57fb922fbb6 + 1.32.1: sha256:d35de1e765481018c7ccdc92edeb59b25938f3bd9d1670440e7ccd3d599f95a7 + 1.32.0: sha256:8f483f1429d2d9cd6bfa6db2e3a4263151701dd4f05f2b1c06cf8e67c44ea67e + 1.31.8: sha256:1730457a0d6cbd9bafe4c4ed33dcfcc843af65b53393d04fb658d42c9ed4d4c5 + 1.31.7: sha256:d97a5e7d282e16d98740d96f72d8d5ea5f0ebd410b6db0357ad8ce0812a08951 + 1.31.6: sha256:0280c799006946b1073e1f66426f103d479268aeb121bff3f845f279828811b3 + 1.31.5: sha256:783dcf77f3539e11ef5fa5cdaf5ea259835055471578541b1009b2f5b79fa099 + 1.31.4: sha256:a66cd010f79c627abdd328d098564200272afa0c6148867317dad73feb07cb1b + 1.31.3: sha256:9241c5676934b1cba216abcd573361b72b5a88fe0696ada0ff338db7cee77b4b + 1.31.2: sha256:d035a728c0c3e05e734d69d4a488d7509ac281fa12ae0c228dee257e9da41237 + 1.31.1: sha256:ea51b7db06ca97ecf7a76d0341ca168dca102a21fb14f97b1fc139c8e7fb1d47 + 1.31.0: sha256:3cc88ce3c19b2f9bbdfaa1bd42eea64bd7d5ffac6e714a83abbdea40df9ef8c2 + 1.30.13: sha256:8a40791ee8be099f861574bfca0908fa1c17f9513c47cb8025c833fe59c6c3c7 + 1.30.12: sha256:5ea864a372c2d897909508d09a4481becaea0577be82d4e5e8983691f3321cf0 + 1.30.11: sha256:5702f05e0ba49ba06e1e8d41f1113701a0a8cb76f418c924b98401b730ab9426 + 1.30.10: sha256:747a78355df3d8fe28c877d84bbafd71dfcd645cb69fbccb5afebfeb1c0bca65 + 1.30.9: sha256:8ef818653159f42da18b9e87e0382a16124ac6037cebdefd46b052a80378e39d + 1.30.8: sha256:c436fa5a91fe9e808eb1563d0ddac6334902f6ad9ef007a132a974bad56c8c9e + 1.30.7: sha256:56c8f0a0d93355264c319da651b2833604c0592678070caf9ebd168a478662e2 + 1.30.6: sha256:832bd6bd8148a90eb10683ebd0a8399fc00bce5c3b46b8c4b0052806752db26d + 1.30.5: sha256:735ee8f838f0ef16dc25658bc2a177d64459e2bf6e8214e1278ca6ce60aa3fb3 + 1.30.4: sha256:2287cc901c18e67b6496522c46f142d5603445bea9395af163b8af5dca9c0924 + 1.30.3: sha256:622809ec7e21350a3ff7897c7d2cabdf4367b1a5904d346514adc485de3c7172 + 1.30.2: sha256:10be07d2626a093b58a29110e84256029d4c46aeb06a6b41e8bddc30bcfcaa4b + 1.30.1: sha256:7293f51295d89106e59fe0f83af9599e71fe4f446e1b13c40687ef63ecc1b194 + 1.30.0: sha256:c2b189febc9f9cb51f84eecad0da955182e31b98a9f456314546bb83ee2a901a + ppc64le: + 1.32.4: sha256:533f6a6d252be8e78a9df4c911df5c3f4b361c608939427839fa4db682ade0a2 + 1.32.3: sha256:bab472e532ed31307f92781717b32016ad02dc25b9a7facf158eab0ff49531c5 + 1.32.2: sha256:680928bbeb84df7e87a17ad059679bb365a8d68781819798175e370629c293e6 + 1.32.1: sha256:e59948b183ca87bf3cf4e54ebd5d3ac9418b1e88af4dc92883323003bd16412a + 1.32.0: sha256:e0544544c91f603afaf54ed814c8519883212bcb149f53a8be9bb0c749e9ec86 + 1.31.8: sha256:1b6f60c58766e1c2bab2e60c10060494500747dd0965e70072367a86182dd8b4 + 1.31.7: sha256:1a2d82271ec5f4c7b4ee9c9eae6e83c62da57928a54de01f47b7f773a2dc20df + 1.31.6: sha256:416afcda1d8bf1e616043942c2c2fe4ccd92f10c829199527ac69c76b93ec44a + 1.31.5: sha256:88acc92f1c8094ca1772246b56b29ac243c3a56184479620ff3c7103fe9e64df + 1.31.4: sha256:4ac60d4585752ce53fa7484e49d458d86fafe76ead8e8b2b8c690135331dba28 + 1.31.3: sha256:0ce44aab3645256ac68840e54aa9720ac559c4b877e1566829b4c4b193999b75 + 1.31.2: sha256:57596bb63aef508e86f3b41672816f02a6dee3b1a71ce472756d2c7aed836407 + 1.31.1: sha256:94b3b1b8cebd3a3b3483cbefd11826fadaa240302c4b61f98c29bd2bf3dd72ee + 1.31.0: sha256:46d901644f86d25dd62f12c16bd88cf26a0b9c400405f571fc5b68abdfefad95 + 1.30.13: sha256:6ec25c7429b1adb0b9803d5d454c96b2a932f4c0f505f4d7cdf6a590d0f5ab46 + 1.30.12: sha256:f9d39a6ba3211b529d30cff409834f36a282ee30cf4a9d48456cfca4e19982dd + 1.30.11: sha256:007e8c9f9a509b028233239464de160948015922beb8063b7775fe5f47c83fe9 + 1.30.10: sha256:39a0fd5837bf644d7ef6a4cc672eff0138c812c620aca44237863ba22a349823 + 1.30.9: sha256:4bbdcd6cad45fa7bdf6f5be95916f45fd3ce9bc8d5cc891406507b7d643d2eb6 + 1.30.8: sha256:08a2103e599be9842d3e0cc3b8e360cdf2e39eb8e0dbfa9541cd89671d43ce35 + 1.30.7: sha256:252313742fa133671546f7e32275e77a860b885d0749b1dd24dfdb5d1560d709 + 1.30.6: sha256:bf4ba36ffa339050b3e29683c17dbe113c7d5c9b7787c3277e21fd5422079dd8 + 1.30.5: sha256:3673325249cbf7d55a29fc3198d34449b523bb0ebc7e4b8a842966b633fe8549 + 1.30.4: sha256:12d269043f8b8ba691c2ca9a1b6aa0ca428922d179a0fe6bf50027d2f1e31535 + 1.30.3: sha256:44ed039a1c0c492b14212bbe59c63fe804e3cc525102f47475a5bc0ffd08f4e8 + 1.30.2: sha256:19169b1ef3324c749a0b0105b47288c0ef4949964b340c85229d00234e6148a1 + 1.30.1: sha256:e6fb05de749a06316d046e46f8ff4345a413264e63f63dc9e3f1db2cb8a7c962 + 1.30.0: sha256:e6fe5c39fa7b7cf8167bb59b94dc9028f8def0c4fec4c1c9028ec4b84da6c53a +kubelet_checksums: + arm64: + 1.32.5: sha256:034753a2e308afeb4ce3cf332d38346c6e660252eac93b268fac0e112a56ff46 + 1.32.4: sha256:91117b71eb2bb3dd79ec3ed444e058a347349108bf661838f53ee30d2a0ff168 + 1.32.3: sha256:5c3c98e6e0fa35d209595037e05022597954b8d764482417a9588e15218f0fe2 + 1.32.2: sha256:d74b659bbde5adf919529d079975900e51e10bc807f0fda9dc9f6bb07c4a3a7b + 1.32.1: sha256:8e6d0eeedd9f0b8b38d4f600ee167816f71cf4dacfa3d9a9bb6c3561cc884e95 + 1.32.0: sha256:bda9b2324c96693b38c41ecea051bab4c7c434be5683050b5e19025b50dbc0bf + 1.31.9: sha256:2debf321e74f430c3832e2426766271f4d51e54927e6ad4be0235d31453dace6 + 1.31.8: sha256:c071aa506071db5f03a03ea3f406b4250359b08b7ae10eeee3cfb3da05411925 + 1.31.7: sha256:c6624e9e0bbf31334893f991f9a85c7018d8073c32147f421f6338bc92ac6f33 + 1.31.6: sha256:79b2bae5f578bae643e44ae1a40c834221983ac8e695c82aad79f2dc96c50ada + 1.31.5: sha256:922a96405fdc3ae41e403565d06c5a6c3b733b0c3d0d1d61086b39c6760103d3 + 1.31.4: sha256:fb6f02f3324a72307acc11998eb5b1c3778167ae165c98f9d49bd011498e72f8 + 1.31.3: sha256:0ec590052f2d1cee158a789d705ca931cbc2556ceed364c4ad754fd36c61be28 + 1.31.2: sha256:118e1b0e85357a81557f9264521c083708f295d7c5f954a4113500fd1afca8f8 + 1.31.1: sha256:fbd98311e96b9dcdd73d1688760d410cc70aefce26272ff2f20eef51a7c0d1da + 1.31.0: sha256:b310da449a9d2f8b928cab5ca12a6772617ba421023894e061ca2647e6d9f1c3 + 1.30.13: sha256:673ffbf0c84814a0625fef0d4e44647ec7cf3786ab839729d2d03782559b3cdf + 1.30.12: sha256:0d280ebaa41b7d4c34977f131cf9cda663db94c3ae33d5613b1729a02b3bedd7 + 1.30.11: sha256:2ead74deda3ae5ab2fac1e1476d5b4c81ad73cf6383c279b5781513b98e43f39 + 1.30.10: sha256:497d403610fda7ff4fefa1c5c467a5fe9efbc3b3368ecd40542ef1e22eff88ca + 1.30.9: sha256:f12aa046f04ec3d0fb2af90b7ff15a8012ffd6d362286f96d2f462bd4f85cfaa + 1.30.8: sha256:fdda0047c8c6a59956db72c781705eb705018d00ba594afffdb15ef630f81e28 + 1.30.7: sha256:cb9d916c3c3332a400b42271be342728d5660a4b78dfaaf7819db8a58cb4caa4 + 1.30.6: sha256:a35e5ab0701b84c03c5cffb142e5de78dc3a5a4af9ba503a6eb3bf8944ded26d + 1.30.5: sha256:6d11af618f410a186a681b95865539a75146cb908522211520df584f3c09d5cc + 1.30.4: sha256:d3df7a4acff9aba5518930b9c417e8e0ca8cf5e105b7fee6504891fa8f3e962a + 1.30.3: sha256:41d1926cd7b9c7c250c45f11c8fa9d1946cae98aec2eefc61a2cb4933612bcce + 1.30.2: sha256:72ceb082311b42032827a936f80cd2437b8eee03053d05dbe36ba48585febfb8 + 1.30.1: sha256:c45049b829af876588ec1a30def3884ce77c2c175cd77485d49c78d2064a38fb + 1.30.0: sha256:fa887647422d34f3c7cc5b30fefcf97084d2c3277eff237c5808685ba8e4b15a + amd64: + 1.32.5: sha256:2b2988edd1646bf139dee6956d4283c520ff151a36febd10701ffda4852b8250 + 1.32.4: sha256:3e0c265fe80f3ea1b7271a00879d4dbd5e6ea1e91ecf067670c983e07c33a6f4 + 1.32.3: sha256:024bb7faffa787c7717a2b37398a8c6df35694a8585a73074b052c3f4c4906ce + 1.32.2: sha256:9927fee1678202719075d8d546390bcda86c9e519b811fb7f4820b6823f84cab + 1.32.1: sha256:967dc8984651c48230a2ff5319e22cbf858452e974104a19bbade5d1708f72ad + 1.32.0: sha256:5ad4965598773d56a37a8e8429c3dc3d86b4c5c26d8417ab333ae345c053dae2 + 1.31.9: sha256:4e5e2bce4e80575a253654877f0156393d79647a36afb784da27f3ddef446456 + 1.31.8: sha256:02697f8d14fc36089954380730f300df78b63dada1dc6f52d8e60bd5ce217d48 + 1.31.7: sha256:279e766a1a7c0dce2efae452c9de1e52b169df31c4b75c9d3b7d51f767ae6d42 + 1.31.6: sha256:ea50176095dd4650f6b270c79cf6d30deaaeb96ffa7d1eaac6924428cc9d2486 + 1.31.5: sha256:4fdedf2b6e3e8c4976c3cd000edf9ae61c94f0d6024ffe8b06bae6218ff2c94e + 1.31.4: sha256:9062fbb2b6054ecab07b9e841b0a49ab4acc224860b01c218d01ba95017c5e49 + 1.31.3: sha256:a5c9e871541251db15436fc307d945217e160d12920730070417ba8037e090df + 1.31.2: sha256:b0de6290267bbb4f6bcd9c4d50bb331e335f8dc47653644ae278844bb04c1fb6 + 1.31.1: sha256:50619fff95bdd7e690c049cc083f495ae0e7c66d0cdf6a8bcad298af5fe28438 + 1.31.0: sha256:39e7f1c61c8389ea7680690f8bd5dd733672fa16875ae598df0fd8c205df57a9 + 1.30.13: sha256:b8d8c3cc0c13b2e42c1d83ab6c03024825bc01887c923fd6f8568ebe066ec28e + 1.30.12: sha256:aab260aa88dd27f785bdb64e7e5be0173bcd1a871d0fa84d5dc7736469f7c395 + 1.30.11: sha256:59177fc92e2b2bb988f7d8d39682ea9e3d9d883273c9c8b51b39502d9b965431 + 1.30.10: sha256:0c7aa1db3fa339aa13af0f825d25a76b3c74f785d4fcd49d6a0bc5a96f0971f0 + 1.30.9: sha256:59c61c8018686bb58be96481f8aa3abe42bba9f791c6dd3c9d4a2ed697187e5b + 1.30.8: sha256:7b5191dfed6a27faadefebdc4a3b602b9a76adfc58fd04c50307f1377eabc590 + 1.30.7: sha256:4b2fb90661e2b7be8b34b5bd405652590f6351a9f55194430fa16d547a7c9d16 + 1.30.6: sha256:9d5585448bc34d37f70171c282febaa10d32687bfee4f8e4467c1bf149674d50 + 1.30.5: sha256:9b4b8f8b33c988372cc9c67791418028ca2cef4a4b4b8d98ab67d6f21275a11a + 1.30.4: sha256:0c02c0f997b3e9769eae7ca051856054411fca947b3d5409d991ce1964dd0e69 + 1.30.3: sha256:9a37ddd5ea026639b7d85e98fa742e392df7aa5ec917bed0711a451613de3c1c + 1.30.2: sha256:6923abe67ef069afca61c71c585023840426e802b198298055af3a82e11a4e52 + 1.30.1: sha256:87bd6e5de9c0769c605da5fedb77a35c8b764e3bda1632447883c935dcf219d3 + 1.30.0: sha256:32a32ec3d7e7f8b2648c9dd503ce9ef63b4af1d1677f5b5aed7846fb02d66f18 + ppc64le: + 1.32.5: sha256:b9cb7bf4b5518e1b5542717c82a753663154e08c84e336feba424cf3575313a3 + 1.32.4: sha256:62e7854ea84bf0fd5a9c47a1ab7ade7a74b4f160efdf486320ed913b4e8e7f79 + 1.32.3: sha256:efc2b01d4ab74f283ab4ff2bad4369e2b9f66fa875673b72627aa6e7a7b507cb + 1.32.2: sha256:3602474e25b0b42a4b0f43ece2ca1e03fe5f3864f0936537256920bbb2eb9acd + 1.32.1: sha256:623889368808042a236d7078d85a23ce5ef0e43b6fadc09bcacfdf704ac876b4 + 1.32.0: sha256:99d409a8023224d84c361e29cdf21ac0458a5449f03e12550288aa654539e3a1 + 1.31.9: sha256:53410497c9abf3355c89997654f0e1f189084888dc56a57199c6ed1c4e3cb61c + 1.31.8: sha256:925bc404df4a54fed659db28e5bc55b5e4b6707f60d8aa26660b2a20f65a804c + 1.31.7: sha256:159be13904091020c2be08a22155f3d3a2e22a0d31d96ceabfa84cabe1dbb6f7 + 1.31.6: sha256:910a4cfc99e18d6065a4d8abcd678559d278797a5de2110050cc75931b000d8f + 1.31.5: sha256:d8b7f6d4dbcab95ffd7914f4888beae24e937848822748f20f458db4148c5c40 + 1.31.4: sha256:184154c5aa25539cf0547bbcde6d8bee7b8e05984f28da8c996a513787eef8ed + 1.31.3: sha256:46bd2fcd44ce9ec2a77009ae8248a3fd652305e9866c562b01524a99b18cda7a + 1.31.2: sha256:b7eb859eaa5494273c587b0dcbb75a5a27251df5e140087de542cb7e358d79b1 + 1.31.1: sha256:5b9e8de02f797991670c3f16fa7e46edc7e862644bfa376573c2fca2eaf01519 + 1.31.0: sha256:b347b96dd79d3ac09e490669b38c5c2a49b5d73cf82cb619a1c54c6e0a165dbb + 1.30.13: sha256:94ce01e6628f8339a9ff06f13e37298bbd2aedbcb3e37e7943ed8d90fd55e91d + 1.30.12: sha256:b49ce79bbaedb9d40805be5f6968c6c9ee9a711dde9fc01831cd257dea7ae8a9 + 1.30.11: sha256:c9f778480278a4bda2c81cdeec7b2bab9c969299054f9e27234359fd5b80d6f3 + 1.30.10: sha256:e2061a23cac69937ab2454fc9f870f6e5cad4debe668e81389fd4a7fde36d3dd + 1.30.9: sha256:111084f90946dd1b191e77237d56871564b0ed4e91ae85ad9fce8b1cb81c1aaf + 1.30.8: sha256:ef3bc0239b9adbbe33ba024c93a1496a1359faa745b0dd16f7e1b8e42a015c2e + 1.30.7: sha256:76c7b73c15baf9b07df36ff39e15ec8e144258900d78bbd9501c6239dacf0d33 + 1.30.6: sha256:a4641d919d28f4a46e6049862a1de5449b009cfa8ee84066451b94374442ba29 + 1.30.5: sha256:ac97aa6ddb6e367ff027c13de8dbd9624a5fe21b6b35546a8603af0ffc608858 + 1.30.4: sha256:50ea965747f3f8c69288aa9268e5c2cc1eb6c3f0b3efa7eba862258bd225d98d + 1.30.3: sha256:c48df46a72ff9764fd1bc54e99b6154772031b1e66c36b0ac5764a5801eadfc0 + 1.30.2: sha256:268dfbb7ee3abcb8ff9fd0a88f81204e40dd33d177f7878941c9ff6b7cca0474 + 1.30.1: sha256:1ac58eae0aa02fefad47d2318bfa5846ae0d7d11a5b691850cd86b2b614ceffe + 1.30.0: sha256:8d4aa6b10bcddae9a7c754492743cfea88c1c6a4628cab98cdd29bb18d505d03 +kubectl_checksums: + arm: + 1.32.5: sha256:7270e6ac4b82b5e4bd037dccae1631964634214baa66a9548deb5edd3f79de31 + 1.32.4: sha256:bf28793213039690d018bbfa9bcfcfed76a9aa8e18dc299eced8709ca542fcdd + 1.32.3: sha256:f990c878e54e5fac82eac7398ef643acca9807838b19014f1816fa9255b2d3d9 + 1.32.2: sha256:e1e6a2fd4571cd66c885aa42b290930660d34a7331ffb576fcab9fd1a0941a83 + 1.32.1: sha256:8ccf69be2578d3a324e9fc7d4f3b29bc9743cc02d72f33ba2d0fe30389014bc8 + 1.32.0: sha256:6b33ea8c80f785fb07be4d021301199ae9ee4f8d7ea037a8ae544d5a7514684e + 1.31.9: sha256:54e560eb3ad4b2b0ae95d79d71b2816dfa154b33758e49f2583bec0980f19861 + 1.31.8: sha256:65fdd04f5171e44620cc4e0b9e0763b1b3d10b2b15c1f7f99b549d36482015d4 + 1.31.7: sha256:870d919f8ef5f5c608bd69c57893937910de6a8ed2c077fc4f0945375f61734d + 1.31.6: sha256:b370a552cd6c9bb5fc42e4e9031b74f35da332f27b585760bacb0d3189d8634d + 1.31.5: sha256:cbb4e470751ef8864ade9d008e848f691ac6cbdee320539797a68a5512b9f7f8 + 1.31.4: sha256:055d1672f63fda86c6dfa5a2354d627f908f68bde6bf8394fdc9a99cadc4de19 + 1.31.3: sha256:e0d00fbac98e67b774ff1ed9a0e6fc5be5c1f08cc69b0c8b483904ed15ad8c50 + 1.31.2: sha256:f2a638bdaa4764e82259ed1548ce2c86056e33a3d09147f7f0c2d4ee5b5e300c + 1.31.1: sha256:51b178c9362a4fbe35644399f113d7f904d306261953a51c5c0a57676e209fa6 + 1.31.0: sha256:a4d6292c88c199688a03ea211bea08c8ae29f1794f5deeeef46862088d124baa + 1.30.13: sha256:da7f49225c9c10f69371e5f351ea3049e3561cf02e92c31e72ee46d8575e8c1a + 1.30.12: sha256:b8a5de1e9abc5c154fb466dd19758edd149cbea05ac4dfd64ba1f82461745f6f + 1.30.11: sha256:ef419b7376850d2ca47413f15d6c94eeefb393ae648c9fb739e931da179adf06 + 1.30.10: sha256:71dc80f99598d9571191e7b5dc52b4c426da960426b3d62e644b173b50a4c2f2 + 1.30.9: sha256:8a629ebd72611351487b2f6ba3ed380772779594db1e7aa35e112a6d277238cd + 1.30.8: sha256:ef0985c6915c2c23407a2a15dbfe5af71c397178a66afdc8e0e60c5b892c4e99 + 1.30.7: sha256:4e3df1c0cd7e1895467525483a213e8f0f37a778c0cbf485e7a62eeb76c73d0e + 1.30.6: sha256:20ca85ccceb5f6539a3075d6faaec8bfc6f6351984e59cbe14f00c1b96c57bab + 1.30.5: sha256:ee26c528357330bd1bb036064d7083d6cc66434acc7ddc003c865ddc10e0d17e + 1.30.4: sha256:a31676f522cc745f241b1fd5755b9965558e4f1f5db5149319439a15f49806d1 + 1.30.3: sha256:f9147ca81cbcb7b1cf41b75d95a0fd3597defb7c0e6db8c54e6ca7f493929c71 + 1.30.2: sha256:2dab982920d87bc9a17c539bfa4f94b758afc454bb044029dee06144e8dbee08 + 1.30.1: sha256:b05c4c4b1c440e8797445b8b15e9f4a00010f1365533a2420b9e68428da19d89 + 1.30.0: sha256:ff54e96c73f4b87d740768f77edada7df8f2003f278d3c79bbbaa047b1fc708d + arm64: + 1.32.5: sha256:9edee84103e63c40a37cd15bd11e04e7835f65cb3ff5a50972058ffc343b4d96 + 1.32.4: sha256:c6f96d0468d6976224f5f0d81b65e1a63b47195022646be83e49d38389d572c2 + 1.32.3: sha256:6c2c91e760efbf3fa111a5f0b99ba8975fb1c58bb3974eca88b6134bcf3717e2 + 1.32.2: sha256:7381bea99c83c264100f324c2ca6e7e13738a73b8928477ac805991440a065cd + 1.32.1: sha256:98206fd83a4fd17f013f8c61c33d0ae8ec3a7c53ec59ef3d6a0a9400862dc5b2 + 1.32.0: sha256:ba4004f98f3d3a7b7d2954ff0a424caa2c2b06b78c17b1dccf2acc76a311a896 + 1.31.9: sha256:1e6de599df408824f13602d73333c08c3528cfa5d6c8c98c633868a966882129 + 1.31.8: sha256:bd76445943b22d976bdbd1d0709e4bcb5f0081cc02c10139f4b3e5e209dc3019 + 1.31.7: sha256:d95454093057af230f09e7b73ee9ae0714cf9e5197fbcb7b902881ca47b7e249 + 1.31.6: sha256:fc40a8bbdba41f022aced2dec729a1b9e937ad99872b430b6c2489f1f36a61f5 + 1.31.5: sha256:697c8b4239f9e53cba46296e114bcc02c726b5c7a45e1c464804aad56e5c7a86 + 1.31.4: sha256:b97e93c20e3be4b8c8fa1235a41b4d77d4f2022ed3d899230dbbbbd43d26f872 + 1.31.3: sha256:a3953ad2b32eca0b429249a5fbdf4f8ef7d57223c45cc0401fd80fd12c7b9071 + 1.31.2: sha256:bb9fd6e5a92c2e2378954a2f1a8b4ccb2e8ba5a3635f870c3f306a53b359f971 + 1.31.1: sha256:3af2451191e27ecd4ac46bb7f945f76b71e934d54604ca3ffc7fe6f5dd123edb + 1.31.0: sha256:f42832db7d77897514639c6df38214a6d8ae1262ee34943364ec1ffaee6c009c + 1.30.13: sha256:afed1753b98ab30812203cb469e013082b25502c864f2889e8a0474aac497064 + 1.30.12: sha256:1af7e16a143c283a29821a09f5a006aacf0fe8368bc18adbd40588ba395e0352 + 1.30.11: sha256:11f86b29416f344b090c2581df4bc8a98ed7cc14a2bb28e46a6d4aa708af19f4 + 1.30.10: sha256:9d65d54f02b0b305d9f3f89d19a60d3e130e09f5407df99f6d48f8c10f31e2ae + 1.30.9: sha256:bab82f333f6347507a4c725bc726fefd3d862eb64a36a4fb8b99bfe9e10813d0 + 1.30.8: sha256:e51d6a76fade0871a9143b64dc62a5ff44f369aa6cb4b04967d93798bf39d15b + 1.30.7: sha256:5e856defeac209ff82dd473ce46f91a3118df82b863de0d2ed59bdf3558cffca + 1.30.6: sha256:0b448581f05f46d80219d1a73bd1966de09066c313f64e67e7b75b35e07191cd + 1.30.5: sha256:efc594857f9255fc33bcda9409b8862a3b47ce5f4e09d51c3427b85dd769b9b9 + 1.30.4: sha256:1d8b4e6443c7df8e92a065d88d146142a202fea5ec694135b83d9668529ea3b1 + 1.30.3: sha256:c6f9568f930b16101089f1036677bb15a3185e9ed9b8dbce2f518fb5a52b6787 + 1.30.2: sha256:56becf07105fbacd2b70f87f3f696cfbed226cb48d6d89ed7f65ba4acae3f2f8 + 1.30.1: sha256:d90446719b815e3abfe7b2c46ddf8b3fda17599f03ab370d6e47b1580c0e869e + 1.30.0: sha256:669af0cf520757298ea60a8b6eb6b719ba443a9c7d35f36d3fb2fd7513e8c7d2 + amd64: + 1.32.5: sha256:aaa7e6ff3bd28c262f2d95c8c967597e097b092e9b79bcb37de699e7488e3e7b + 1.32.4: sha256:10d739e9af8a59c9e7a730a2445916e04bc9cbb44bc79d22ce460cd329fa076c + 1.32.3: sha256:ab209d0c5134b61486a0486585604a616a5bb2fc07df46d304b3c95817b2d79f + 1.32.2: sha256:4f6a959dcc5b702135f8354cc7109b542a2933c46b808b248a214c1f69f817ea + 1.32.1: sha256:e16c80f1a9f94db31063477eb9e61a2e24c1a4eee09ba776b029048f5369db0c + 1.32.0: sha256:646d58f6d98ee670a71d9cdffbf6625aeea2849d567f214bc43a35f8ccb7bf70 + 1.31.9: sha256:720d31a15368ad56993c127a7d4fa2688a8520029c2e6be86b1a877ad6f92624 + 1.31.8: sha256:be0aa44a50a9aada4e9402e361ffb0d5bb1fd4f6950751399fcaf3b8b936a746 + 1.31.7: sha256:80a3c83f00241cd402bc8688464e5e3eedd52a461ee41d882f19cf04ad6d0379 + 1.31.6: sha256:c46b2f5b0027e919299d1eca073ebf13a4c5c0528dd854fc71a5b93396c9fa9d + 1.31.5: sha256:fbecbfd375b3686002c2e81d51c390172f5ffba3d6b47920d55342cb03f557af + 1.31.4: sha256:298e19e9c6c17199011404278f0ff8168a7eca4217edad9097af577023a5620f + 1.31.3: sha256:981f6b49577068bc174275184d8ee7105d8e54f40733792c519cd85023984c0f + 1.31.2: sha256:399e9d1995da80b64d2ef3606c1a239018660d8b35209fba3f7b0bc11c631c68 + 1.31.1: sha256:57b514a7facce4ee62c93b8dc21fda8cf62ef3fed22e44ffc9d167eab843b2ae + 1.31.0: sha256:7c27adc64a84d1c0cc3dcf7bf4b6e916cc00f3f576a2dbac51b318d926032437 + 1.30.13: sha256:b92bd89b27386b671841d5970b926b645c2ae44e5ca0663cff0f1c836a1530ee + 1.30.12: sha256:261a3c4eb12e09207b9e08f0b43d547220569317ed8d7a22638572100ace5b80 + 1.30.11: sha256:228a8b2679f84de9192a1ac5ad527c9ab73b0f76c452ed74f11da812bbcfaa42 + 1.30.10: sha256:bc74dbeefd4b9d53f03016f6778f3ffc9a72ef4ca7b7c80fd5dc1a41d52dcab7 + 1.30.9: sha256:d77041f285d9237c4aa451370c3ec6e5c042007dbb55c894f0a179b1d149bf32 + 1.30.8: sha256:7f39bdcf768ce4b8c1428894c70c49c8b4d2eee52f3606eb02f5f7d10f66d692 + 1.30.7: sha256:3950ec7b81b9aa5a3856dd6155e42e1ad12a2fa8b050502f5a9652050f94a8ee + 1.30.6: sha256:7a3adf80ca74b1b2afdfc7f4570f0005ca03c2812367ffb6ee2f731d66e45e61 + 1.30.5: sha256:b8aa921a580c3d8ba473236815de5ce5173d6fbfa2ccff453fa5eef46cc5ee7a + 1.30.4: sha256:2ffd023712bbc1a9390dbd8c0c15201c165a69d394787ef03eda3eccb4b9ac06 + 1.30.3: sha256:abd83816bd236b266c3643e6c852b446f068fe260f3296af1a25b550854ec7e5 + 1.30.2: sha256:c6e9c45ce3f82c90663e3c30db3b27c167e8b19d83ed4048b61c1013f6a7c66e + 1.30.1: sha256:5b86f0b06e1a5ba6f8f00e2b01e8ed39407729c4990aeda961f83a586f975e8a + 1.30.0: sha256:7c3807c0f5c1b30110a2ff1e55da1d112a6d0096201f1beb81b269f582b5d1c5 + ppc64le: + 1.32.5: sha256:1fc869a9d620982f16104f3b33c393aba54dd41136d18009bf6fc39accf6465c + 1.32.4: sha256:61a8c1f441900b4e61defcb83bb54f61f883f9e75810897cfabfd6860ae7e195 + 1.32.3: sha256:11e1a377f404bdab6e3587375f7c2ee432df80b56d7ccf6151d4e48cd8063f55 + 1.32.2: sha256:c25500027cd331ae3e65bed2612491c5307721894e9d39e869f24ca14973677f + 1.32.1: sha256:46d98d3463e065dff035d76f6c2b604c990d79634cc574d43b0c21f0367bbf0c + 1.32.0: sha256:9f3f239e2601ce53ec4e70b80b7684f9c89817cc9938ed0bb14f125a3c4f8c8f + 1.31.9: sha256:4a2786e8f5dcc2acc3820795811289d5a8e80ff34b5e311ac226af389236da94 + 1.31.8: sha256:4cc6503cecca4a385362392dc9b350837cd00a654ffc7ad424cc30ebf04c3fab + 1.31.7: sha256:c00f6aca4ef62dac55b2e7e818c7907704ea96b72ff4861303ee1b5ac4a1158f + 1.31.6: sha256:678d2299674c20414d83224caad9c4b8290105c2962c911ec90a2e661777e3aa + 1.31.5: sha256:5d00492e969cfd8a4389fec4f23832321856c1aab0387d255cfb66a1b1bdbe26 + 1.31.4: sha256:5089625fc8f4dc7082c6e0186a839c8d4e791ad15bcbbc586d4839f25f12a3df + 1.31.3: sha256:a5855c5fb02cc40c68eee603f08a5c5bcf86d85e6c9e757f450d4fd6138e89d4 + 1.31.2: sha256:3a9405b1f8f606f282abb03bf3f926d160be454c21b3867505f15ad2123d4139 + 1.31.1: sha256:635275e4b207902bc6dda29de898e5152229271c46cb9613340e36c3abc2cb67 + 1.31.0: sha256:92393bc295423429522fa8c49724f95f31fa9bf20062d2c123e928d08886c95d + 1.30.13: sha256:48a0287fb9d7b35bc2b7095976fcaf57225e9d3ae3d5c9c0165219f8d0ba39e9 + 1.30.12: sha256:d6434d10b4347cfe1aa93092bc8dd89a9ef0dd40e85b5aba7a705facfbff103f + 1.30.11: sha256:d3de093b8b4c791aa171ad895c44fd738aa5b30135e4c7ee78ee6ac59b2967f2 + 1.30.10: sha256:1bd3adfcb66189575817e7e0149ecb1b6fc157bf06763232ed8d360df8ff29ab + 1.30.9: sha256:4a45bb72eedbadad75a543d99ce388f9125220e36eef6ec42adfdc2dbc959611 + 1.30.8: sha256:76b7ecd7212c939271493204c726e8e7ea56ac748005c901bec3f6598ee479e0 + 1.30.7: sha256:7992f401b75399ea8a1ded372badf75da643835f0fe4645f0668c3720006a3cd + 1.30.6: sha256:54ae05b59c52edea26e1d4009b5e469be96d582ddbe388f33d3b07a66caf7ac8 + 1.30.5: sha256:1289eec1144607b5b11bb4f1bdbba6ee92880f4703c9349c83b47ae6d66d9614 + 1.30.4: sha256:a913b4b8573d356483d5c7f14d2cecb290b41ab3b58812567b54ce09e763aad9 + 1.30.3: sha256:3f2ba2216e43b833251a570b1218cba61d43ef2734c0a7751d281656066ab30b + 1.30.2: sha256:738bc1bad45df79fc4313d167a68ed5a1cf747f1f94e4434f0733e3126989f2e + 1.30.1: sha256:ef01ae21e91600469db3df01172144fac6c61083e7d3282bef72ce732d76d0d8 + 1.30.0: sha256:f8a9eac6e12bc8ab7debe6c197d6536f5b3a9f199e8837afd8e4405291351811 +kubeadm_checksums: + arm64: + 1.32.5: sha256:2956c694ff2891acdc4690b807f87ab48419b4925d3fad2ac52ace2a1160bd17 + 1.32.4: sha256:1b9d97b44758dc4da20d31e3b6d46f50af75ac48be887793e16797a43d9c30e7 + 1.32.3: sha256:f9d007aaf1468ea862ef2a1a1a3f6f34cc57358742ceaff518e1533f5a794181 + 1.32.2: sha256:fd8a8c1c41d719de703bf49c6f56692dd6477188d8f43dcb77019fd8bc30cbd3 + 1.32.1: sha256:55a57145708aaa37f716f140ef774ca64b7088b6df5ee8eae182936ad6580328 + 1.32.0: sha256:5da9746a449a3b8a8312b6dd8c48dcb861036cf394306cfbc66a298ba1e8fbde + 1.31.9: sha256:d8f5dbb17ce2dead6aedcc700e4293a9395e246079fcdc1772ab9e5cbfeca906 + 1.31.8: sha256:d0d1a6634e397e4f14b1e5f9b4bd55758ea70bfc114728730d25d563952e453e + 1.31.7: sha256:3f95765db3b9ebb0cf2ff213ac3b42a831dd995a48d9a6b1d544137d3f2c3018 + 1.31.6: sha256:03b6df27c630f6137be129d2cef49dc4da12077381af8d234a92e451ba2a16d2 + 1.31.5: sha256:971904ff1ac2879d968cac1d4865b7c0ce0d9374506bd17bd0b123981803769b + 1.31.4: sha256:4598c2f0c69e60feb47a070376da358f16efe0e1403c6aca97fa8f7ab1d0e7c0 + 1.31.3: sha256:8113900524bd1c8b3ce0b3ece0d37f96291cbf359946afae58a596319a5575c8 + 1.31.2: sha256:0f9d231569b3195504f8458415e9b3080e23fb6a749fe7752abfc7a2884efadf + 1.31.1: sha256:66195cd53cda3c73c9ae5e49a1352c710c0ea9ce244bbdeb68b917d809f0ea78 + 1.31.0: sha256:dbeb84862d844d58f67ad6be64021681a314cda162a04e6047f376f2a9ad0226 + 1.30.13: sha256:53a256e2ff51d51079e73c5856acfe4c2b1b71ea614aee3e832cf0a72b45fc71 + 1.30.12: sha256:7abc2db71e0ab3c7c30546851d254542f2c6778d4022437a47a1d48bd722a5d1 + 1.30.11: sha256:644f70389d6f5186685a2d94c0221b55a280a9ec14bd3f3609f008d9244c70e8 + 1.30.10: sha256:1dfba299e19ce4b1e605d39604b898c723274eba51495bd8547732a35b90a8c1 + 1.30.9: sha256:e6363fd0da7ff38d1dd26cf661cb925efe5579bc52dd5db351d7f0b9657ab27e + 1.30.8: sha256:7bca884b54e2c3988e81250f8eba6a49d718994dd7fe67d14905cb65dcec8b56 + 1.30.7: sha256:3684d219d3398964038d87bf609266149cd898d810a52d21a4a6534f8a187ba8 + 1.30.6: sha256:6206938156e079d1c3031ba9a291e720c9f04031492753759b93bc3b67b3390b + 1.30.5: sha256:08b8d17ac39a49b3ebb88a756599496c71e63b756884e88127654bc5c51128e5 + 1.30.4: sha256:609afad8590afb39b500cc5175c64b17690f7bf0b0eebcf1d347656d262e5c8c + 1.30.3: sha256:6590f2447c87346aac29e2ab42fe4f29873f9bf154ee878f00da4c81bfdb8ea2 + 1.30.2: sha256:7268762b7afd44bf07619985dd52c376b63e47d73b8f9a3b08cc49624a8fbd55 + 1.30.1: sha256:bda423cb4b9d056f99a2ef116bdf227fadbc1c3309fa3d76da571427a7f41478 + 1.30.0: sha256:c36afd28921303e6db8e58274de16c60a80a1e75030fc3c4e9c4ed6249b6b696 + amd64: + 1.32.5: sha256:9070c3d469f5a3e777948b63a7a5e6c5bd7682c7416547770a78880fe4293ea9 + 1.32.4: sha256:445cdebd140dc0a9f4d18505821dcca77d7a21992133bf6731777f5724968255 + 1.32.3: sha256:be42caa726b85b7723605ca8fea22e4a26e0d439b789a3d9d6e636a7078b3db4 + 1.32.2: sha256:fb3a90f1bfc78146a8a03b50eb59aaf957a023c1c5a2b166062ef9412550bba6 + 1.32.1: sha256:5ed13bb4bc1d5fb4579b8cc8c7c2245356837122f9a3fd729c2f6d1338f58dcf + 1.32.0: sha256:8a10abe691a693d6deeeb1c992bc75da9d8c76718a22327688f7eb1d7c15f0d6 + 1.31.9: sha256:9653845e48754df94842cce1ef76874e7f4c1a32d782dd0c7e6cf12e3a718dde + 1.31.8: sha256:b979b58548902a152b0ab89265347c34aac9f1c7e9666953806267d033f0d63b + 1.31.7: sha256:be84c87c7b40977edf67fb8ee231abb273b93bbab5bb770af0f3f37c0d7c4b81 + 1.31.6: sha256:c9d9add6c8cdbeb29d5e1743f23060fc06219b23f561eb9f959b5502fb055611 + 1.31.5: sha256:879add53ba3ed7e86bdb3b06d1ebb1f5e31b9a01e3bc57353d6385422febbd73 + 1.31.4: sha256:6c8e2fd2fa2cab51debf215fcb9149b94e7046f69ff558290066875200975cf6 + 1.31.3: sha256:dcfcc6eb79e94994d5f1b04a7746239214030ce8a2e8b0e21a4772938f911d12 + 1.31.2: sha256:e3d3f1051d9f7e431aabaf433f121c76fcf6d8401b7ea51f4c7af65af44f1e54 + 1.31.1: sha256:b3f92d19d482359116dd9ee9c0a10cb86e32a2a2aef79b853d5f07d6a093b0df + 1.31.0: sha256:cf3b1a44b11ab226e40610e63d99fae7588a82940bb77da471a6dec624c819c2 + 1.30.13: sha256:dbea796b7b716f7b30ea99e021c3730ef3debace4c8a62c88abfc266b3ab7a96 + 1.30.12: sha256:88422e8b3749b5eaf50a9889a56ee5615cd8a027711f26c6687788e758b949f8 + 1.30.11: sha256:06ff7ff15b7fa9af60189fdece5f7c56efa8b637c38b4a498715ca2f04ccfcb2 + 1.30.10: sha256:177254194194975df68fd69a3647c86260a6c635bee42f516d3cecc047c4bc7c + 1.30.9: sha256:f763a8f5616cf1da80d88555b3654ab6aacd62dc62e6ba7dd2d540c34eea24c0 + 1.30.8: sha256:ffe1a2b6345fae55e059afe7eed90ae9f46f0a755fde5fc17b9113134ab8b79e + 1.30.7: sha256:3635901a3a6e5b0124547151de700a1dbd4571531327a32edbec43bb155b877b + 1.30.6: sha256:216b7728c6eca12a6a21a7e4199d898d4b88cf8f489a63c2779e2e525302cca7 + 1.30.5: sha256:b91e32e527d3941369cee016fccb6cb12cd214a120a81d8c5f84c7cbc9e120b2 + 1.30.4: sha256:6c6053fb8b31030ef7fffe146eb29489f7bf53d7a5ca10e0b10c907bf4b7e281 + 1.30.3: sha256:bb78c2a27027278ee644d523f583ed7fdba48b4fbf31e3cfb0e309b6457dda69 + 1.30.2: sha256:672b0cae2accce5eac10a1fe4ea6b166e5b518c79ccf71a2fbe7b53c2ca74062 + 1.30.1: sha256:651faa3bbbfb368ed00460e4d11732614310b690b767c51810a7b638cc0961a2 + 1.30.0: sha256:29f4232c50e6524abba3443ff3b9948d386964d79eb8dfefb409e1f8a8434c14 + ppc64le: + 1.32.5: sha256:9ace8b24eba37d960a9cafd947015722c383bd695767b7a7c8449a4f6a3f3e9e + 1.32.4: sha256:fb0223765d57c59ff4202445b3768e848b6d383dfac058b5882696bca0286053 + 1.32.3: sha256:68cc7669e47575ead58563c39abf89c7faf1c70fb6733ea9c727f303f2af1abf + 1.32.2: sha256:02573483126e39c6b25c769131cf30ea7c470ad635374be343d5e76845a4ecdb + 1.32.1: sha256:ff7f1dd3f1a6a5c0cf2c9977ec7c474bd22908850e33358dd40aeba17d8375b0 + 1.32.0: sha256:d79fe8cbd1d98bcbe56b8c0c3a64716603581cecf274951af49aa07748bf175a + 1.31.9: sha256:0edee6d9df59cbde094dc7c78bc2cb326ef5ee05072a41196413d1952d078224 + 1.31.8: sha256:ce95a67e563099bf0020c8b577d12e1acd28fa622a317c5dbea4dcba38f1a4db + 1.31.7: sha256:98c501edf7ceb4defd84a6925d9c69f6a8053f16342091af946ff2f2bdace10b + 1.31.6: sha256:03cd9275b9437fc913cbc7b4a365671bd9cb52e67525dd1ba154c792bbfc44fa + 1.31.5: sha256:44c796865dbf1d69c20f534577f5fa9065fff6cb7067df1d5c653b8505d6345f + 1.31.4: sha256:9d0a6abf9595f79660f29625ed649df4f64369e1552aa68eb7ad49b45455ab04 + 1.31.3: sha256:646130bbb60949bdc9b7a449298537369b0eff0ff39b9f7f4222a4760ab824be + 1.31.2: sha256:57771542703fbb18916728b3701298fda62f28a1d9f144ae3712846d2bb50f8a + 1.31.1: sha256:76667e109e2dfcb332820c35f598b6f588b6f18c8b59acfb956fb9b4995dda4e + 1.31.0: sha256:002307ea116a5aa5f78d3d9fb00e9981593711fb79fdfc9be0a9857c370bdcf3 + 1.30.13: sha256:6751937c03c3202afe650b015ded5ff2d2ec63db2d1a87fae50f07f3084049d8 + 1.30.12: sha256:dda533c81cbe3cc130f78dffa46c839015a5b75d889c95ee178f8989ff7d21f9 + 1.30.11: sha256:93f26ae616ad31d59a4160d1948a7b3a621cf8e8b47efe55e7ed84f9667a94fa + 1.30.10: sha256:fe825263316c29eb9cf78267ad524953865d058744135121b6b0b5aa0dcbee8c + 1.30.9: sha256:0210c7e644231a63765e5524edce039124cc5a3051fd7ee32f227645f29b17aa + 1.30.8: sha256:48b8eefb82a9b5646286bb0479dea8c690da62b1bf9b8d5515cd854316837ad5 + 1.30.7: sha256:62d1cd87f541b5eb179b968577e26d72e23b053f3eee4946bbc1a61dc9b6a03d + 1.30.6: sha256:8febc55f1a984b23deb3ecca2dfe7073180f462636512dbfdfb69537c0783ec2 + 1.30.5: sha256:996a353e6a443a1d88fa2aff93beb9f6b3073c53d0565dcccc2886642ce79c05 + 1.30.4: sha256:df0a42a57e69f3080871736d0953f1f287f63def0ed514324aca2469463efd7a + 1.30.3: sha256:76a58a7389365295fb4ea1163c2644c3700f066a8e8cb1b7897ad83576e43ce2 + 1.30.2: sha256:8aee71554003411470a5933cdff7896736ae1182055c0de6bb3782d0a7581c71 + 1.30.1: sha256:dc529fae8227422a23a8d4f70e28161fa207a4da7cb24d340aae0592dd729ea5 + 1.30.0: sha256:a77badcaff292862df8324e17f74ab7ce3c6ea9f390647878f1838a3a832f413 +etcd_binary_checksums: + arm64: + 3.5.21: sha256:95bf6918623a097c0385b96f139d90248614485e781ec9bee4768dbb6c79c53f + 3.5.20: sha256:f034232e6fb64b0d89c45fd78b8b4c3e9fb8d69605dddddcdebf5d7cd96a1531 + 3.5.19: sha256:a786fd2c92c3c0404586ffedf1b318e4944a17aefed1fa6566f5712ddb8359ad + 3.5.18: sha256:c2bcaf465537d6d47c8bb82a69e31f786f32257050e3bca445bc4e63479ec714 + 3.5.17: sha256:7d717a62520bf39fa1115dfbb1df79479ff74b5eda0914f4132bfa60a48b9549 + 3.5.16: sha256:8e68c55e6d72b791a9e98591c755af36f6f55aa9eca63767822cd8a3817fdb23 + 3.5.15: sha256:5aa28b435edb1f22bf6455f754e16a13e3e4eb1ad8fc7c22ad47aa8e722febf2 + 3.5.14: sha256:90510c79c4aae3c3313691f5770fc53b3ac883338fc0254bf8d22460acd3c19d + 3.5.13: sha256:2854993bf622764ccdeb7a146fae2965cb0fcba93c5c8f391e0d5f153c8a7a02 + 3.5.12: sha256:31f30c01918771ece28d6e553e0f33be9483ced989896ecf6bbe1edb07786141 + 3.5.11: sha256:6edf0cddc8fa2d7674129abe2e44d5a37cc3a6e3b500c13c6cbc2ed2ecf08bf4 + 3.5.10: sha256:ff74a6018d9b2a1320bff30e5a11b4f2f5c2a3d147df8a8bad53c01b9f800ee1 + 3.5.9: sha256:bb201c106a61bbab59e2d9f37f4bdff99d50201f513c66b4578741eab581fb28 + 3.5.8: sha256:3f4441b293a2d0d4d2f8b2cd9504376e15818f7b865ef4b436e8e6f865f895ff + 3.5.7: sha256:1a35314900da7db006b198dd917e923459b462128101736c63a3cda57ecdbf51 + 3.5.6: sha256:888e25c9c94702ac1254c7655709b44bb3711ebaabd3cb05439f3dd1f2b51a87 + amd64: + 3.5.21: sha256:adddda4b06718e68671ffabff2f8cee48488ba61ad82900e639d108f2148501c + 3.5.20: sha256:9ac85616fb8c0e45f485074dde0258ca2b7b42f1dd5320821af5a8b66daf7072 + 3.5.19: sha256:16ae742def5f330800590e8d505d72830a3b0b7012e559e6bd76f0bc9864bf42 + 3.5.18: sha256:6ddde039a7a506badf34e7edfb38e1ea90e36f05c8cfceba602045df623d86fa + 3.5.17: sha256:eff6ac621d41711085d0f38fab17d8fa3705f6326c3ff11301a1f5a71fc94edd + 3.5.16: sha256:b414b27a5ad05f7cb01395c447c85d3227e3fb1c176e51757a283b817f645ccc + 3.5.15: sha256:3f6b48d8c2844699f2b19c1880508ecf63e1489769ed37ebb97495d5cd848a89 + 3.5.14: sha256:b0b34298f53f6830f08e7ddc57fc74dc45563216a66e94d9e6b0b9e0b0281b34 + 3.5.13: sha256:31e6fcbee0e8c3df27cf1ba69b522e338377f5ed6447f5d05700aee367f3b7e7 + 3.5.12: sha256:f2ff0cb43ce119f55a85012255609b61c64263baea83aa7c8e6846c0938adca5 + 3.5.11: sha256:e256885e753dc99001335e099d3c2eb8cf21a865a087ee4d7e3665752ae5929a + 3.5.10: sha256:26e90d024fa2310bc52bb40e7f2132e81640b55f8fc446c00ae07e30af2a44fd + 3.5.9: sha256:d59017044eb776597eca480432081c5bb26f318ad292967029af1f62b588b042 + 3.5.8: sha256:d4c1b8d90ad53658f12ffc293afc5694b7bc6cb093af609188649a799e1cc8dc + 3.5.7: sha256:a43119af79c592a874e8f59c4f23832297849d0c479338f9df36e196b86bc396 + 3.5.6: sha256:4db32e3bc06dd0999e2171f76a87c1cffed8369475ec7aa7abee9023635670fb + ppc64le: + 3.5.21: sha256:6fb6ecb3d1b331eb177dc610a8efad3aceb1f836d6aeb439ba0bfac5d5c2a38c + 3.5.20: sha256:563bdac64fc92442cf366c02294dff1cbbd3885a86dbcf7f2e87d9388c3b3223 + 3.5.19: sha256:cc8651929f4d5794892eeeabf612a243ea6233125bc5f8b0f711118736e2710f + 3.5.18: sha256:ad90260978a9a94572c8aedfa3c4ab225a451e84ab01a1df35e4124863672999 + 3.5.17: sha256:5c737b586a1ebcc12bf0d68a2b56583764f4aba82ab4934629626da93d4a9ecc + 3.5.16: sha256:33322806f4a2aa3d4947a4d42ec6a120296535e7f00e2f9d74e515e9386333e0 + 3.5.15: sha256:6512f7308a0d0af7c9bb46bca1c4f4e816304304d838d1045ae21d9772c5490e + 3.5.14: sha256:01681d4d33bba5130c9cffca42c35b0f68e0d991b0b4ee65dab6fd36568d4fee + 3.5.13: sha256:f372b524e2c118dbb0dbe1097474a072fc93bc30da65efa92999137303bcd9a7 + 3.5.12: sha256:ebd8060508d572678d8d1e4f90f87863e3a6cfcba856ceca32379b03251c0597 + 3.5.11: sha256:a2e70b291811fa8ccc34cc7d297bf7d31e3af790bc31e54cad034a49e9db2eb7 + 3.5.10: sha256:10cd8e4ecf6718b9712bf2edfac2e4924d7f21dbe58d368e6e10578c85bd8c01 + 3.5.9: sha256:551539ebb344ebdc77f170ea51512a6cda35877ffdcbd8b3316b2495a8b2bd87 + 3.5.8: sha256:20e28302c1424b1a3daf7d817f2662e4c64e395a82765d1696cb53cb6bc37a4e + 3.5.7: sha256:e861aa6acd4d326ec01bfa06fffb80d33f3f8c26e0eb8b73e4424578d149bd04 + 3.5.6: sha256:e235cb885996b8aac133975e0077eaf0a2f8dc7062ad052fa7395668a365906b +cni_binary_checksums: + arm: + 1.4.1: sha256:50a794507a32edbae8e2fe450f228b5c9c5072e6d958d8c2dc5cd157d4d4fdb0 + 1.4.0: sha256:6cddc5804fff93b914f3314d62fa03f24d69f59c03940e0bbe85a370371b5bb8 + 1.3.0: sha256:86c4c866a01a8073ad14f6feec74de1fd63669786850c7be47521433f9570902 + 1.2.0: sha256:fde5bf2da73995196d248177ee8deeafa8005f33cbe1ab33bd2d75c17ca5a99a + 1.1.1: sha256:84f97baf80f9670a8cd0308dedcc8405d2bbc65166d670b48795e0d1262b4248 + 1.1.0: sha256:91e03a9287dcf8d0249159c90357b0f871ecf7ef0ca5014b2e143f2b30ae9c6d + 1.0.1: sha256:d35e3e9fd71687fc7e165f7dc7b1e35654b8012995bbfd937946b0681926d62d + 1.0.0: sha256:910c2ba8b6f50b1081b219d6db04459b555940973249fcf39a792932a91f6d39 + arm64: + 1.4.1: sha256:56fe62d73942cffd8f119d2b8ecb6a062e85f529a3dbfc7aa5cd83c2c01929a7 + 1.4.0: sha256:304d4389d5b732b7a73513d002c4895f731d030682d40653f411e10e39114194 + 1.3.0: sha256:de7a666fd6ad83a228086bd55756db62ef335a193d1b143d910b69f079e30598 + 1.2.0: sha256:525e2b62ba92a1b6f3dc9612449a84aa61652e680f7ebf4eff579795fe464b57 + 1.1.1: sha256:16484966a46b4692028ba32d16afd994e079dc2cc63fbc2191d7bfaf5e11f3dd + 1.1.0: sha256:33fc7b8d9d5be2d7f95e69e6a9e2af206879942f1e6b7615c04017dce5067f1a + 1.0.1: sha256:2d4528c45bdd0a8875f849a75082bc4eafe95cb61f9bcc10a6db38a031f67226 + 1.0.0: sha256:736335bc5923a37cfb6cc2305489ce6206bcc565004f525b5f7c3604f092aa3a + amd64: + 1.4.1: sha256:2a0ea7072d1806b8526489bcd3b4847a06ab010ee32ba3c3d4e5a3235d3eb138 + 1.4.0: sha256:c2485ddb3ffc176578ae30ae58137f0b88e50f7c7f2af7d53a569276b2949a33 + 1.3.0: sha256:754a71ed60a4bd08726c3af705a7d55ee3df03122b12e389fdba4bea35d7dd7e + 1.2.0: sha256:f3a841324845ca6bf0d4091b4fc7f97e18a623172158b72fc3fdcdb9d42d2d37 + 1.1.1: sha256:b275772da4026d2161bf8a8b41ed4786754c8a93ebfb6564006d5da7f23831e5 + 1.1.0: sha256:05d46ac19d01669d424ee57401c0deba101763ac494858064b4ea4ffdcc37c5d + 1.0.1: sha256:5238fbb2767cbf6aae736ad97a7aa29167525dcd405196dfbc064672a730d3cf + 1.0.0: sha256:5894883eebe3e38f4474810d334b00dc5ec59bd01332d1f92ca4eb142a67d2e8 + ppc64le: + 1.4.1: sha256:7de34118d5195396ed48d51af98fafe7e480e532ae8bd66cc10bf94346d6fa8c + 1.4.0: sha256:c87a36a75ad1692933e3218cae734ba809ae2190c725a050ac9033fc96d2ed26 + 1.3.0: sha256:8ceff026f4eccf33c261b4153af6911e10784ac169d08c1d86cf6887b9f4e99b + 1.2.0: sha256:4960283b88d53b8c45ff7a938a6b398724005313e0388e0a36bd6d0b2bb5acdc + 1.1.1: sha256:1551259fbfe861d942846bee028d5a85f492393e04bcd6609ac8aaa7a3d71431 + 1.1.0: sha256:98239a57452e93c0a27ba9f87bcbb80c7f982f225246f3fe4f3f5ac9b6b1becb + 1.0.1: sha256:f078e33067e6daaef3a3a5010d6440f2464b7973dec3ca0b5d5be22fdcb1fd96 + 1.0.0: sha256:1a055924b1b859c54a97dc14894ecaa9b81d6d949530b9544f0af4173f5a8f2a +calicoctl_binary_checksums: + arm64: + 3.29.3: sha256:d6cba570af9162dff56714ac5e22dfdd170742bc58a51211f587875a3de79fc4 + 3.29.2: sha256:3a9b80335338b7f4af762d4a7cf68e67b40839e50711fbe6e67f9a62b69bafdd + 3.29.1: sha256:6f662d316a267854dc5487242ca7ec8ca70c35b52bed258aafb76c2d113643c2 + 3.29.0: sha256:ab23afb283fcdffcf0e1156cdced68d05b6c2b70fd4ea2cbc3189d0ecd43bdfd + 3.28.4: sha256:48887a6dd715f7340511788c3f311810326e61dcce5a6c1554e365cd372ffab1 + 3.28.3: sha256:b61b5206bc7795793edf792040acf5c52d48ff5de701001d0dbbd850edd0c077 + 3.28.2: sha256:8ebe965424ac94084499182b2853de62e5d18cdc346a3b8974e991d8b7a9592d + 3.28.1: sha256:c062d13534498a427c793a4a9190be4df3cf796a3feb29e4a501e1d6f48daa7c + 3.28.0: sha256:c4ca8563d2a920729116a3a30171c481580c8c447938ce974ce14d7ce25a31bf + 3.27.5: sha256:1c929538565c9f885debb45cc38b3efb4e58d362400163a2eff2b56fad838334 + 3.27.4: sha256:8544b601a67e0594009dafef6d3237fcf6f32fb64726c09abc1f2ce9d6819496 + 3.27.3: sha256:1fc5f58a18d8b1c487b4663fc5cbe23b45bd9d31617debd309f6dfac7c11a8ef + 3.27.2: sha256:0fd1f65a511338cf9940835987d420c94ab95b5386288ba9673b736a4d347463 + 3.27.0: sha256:b4b8c71f9658165e45336b9b5e4fad865529feeffe4294247eb5b4c4310dcaf9 + amd64: + 3.29.3: sha256:8101eef6d31ca80db0c64c7ab8930f657dafc1f8696f145ef5d5f162026eedda + 3.29.2: sha256:6076d6745c4d60c0c4322961cbb256a0ffa8476cf7f8dbe5de4ae82c55bca020 + 3.29.1: sha256:2ac849181cb1fb40c61c06d075711025cdb909d80562d078cc548d50a0edcd3d + 3.29.0: sha256:df5048549d72a1f7ea4f61c655699d3b16d8a45873f28c3855c39597b73e8a3d + 3.28.4: sha256:ff07f5ac4dbf9a849adb12db20e7b35857869fb98b23e802404dbb4a8a98e013 + 3.28.3: sha256:b7dc6d01407ea04c110b8d50312591d7a7c3aa5239c875354ced83ac6b924137 + 3.28.2: sha256:d7f30447f0f59262051b95bdc656407442c4f71066dc37ddd3b676108fab569d + 3.28.1: sha256:22ec5727c38dbe19001792b4ca64ac760a6e2985d5c1a231d919dbebe5bca171 + 3.28.0: sha256:4ea270699e67ca29e5533ddb0a68d370cb0005475796c7e841f83047da6297b6 + 3.27.5: sha256:0a63022166b353ebea49a2f250793019edf531dd5cdb0655da746e7c243aacba + 3.27.4: sha256:84f2bd29ef7b06e85a2caf0b6c6e0d3da5ab5264d46b360e6baaf49bbc3b957d + 3.27.3: sha256:e22b8bb41684f8ffb5143b50bf3b2ab76985604d774d397cfb6fb11d8a19f326 + 3.27.2: sha256:692f69dc656e41cd35e23e24f56c98c4aeeb723fed129985b46f71e6eb5e1594 + 3.27.0: sha256:46e79ae146b3dd90998f56511cf5d6db64deb97cb784235caf1f99e0672d66e4 + ppc64le: + 3.29.3: sha256:edb98d2a0d3f8afbf98eb000f0d535d4678af39dd6e10a09ea5615a4824f692f + 3.29.2: sha256:6f3fd72be26fcf52605d9ece716363a73bb194ca59ee34a257156d30fa5c1542 + 3.29.1: sha256:ef6064f2ec1a09b5eb8c43ab0c64bd42785c24f5b22b950583fb5074f472c2b7 + 3.29.0: sha256:c9c2a29a349c6f681aa79b5f5d6aee738305d95aa7f158b6217f487808758e53 + 3.28.4: sha256:9646b8b66981ed68017d30291f44e3e4ff1f6ce318c88c1e837097c061e2bb79 + 3.28.3: sha256:08bfe47df894ae22f2a1256f28b46345cc1718cd9c936ca8248ae5b761c33dab + 3.28.2: sha256:9889a2f9c26ae82a501b33440b3a0772f552a4ece128cd57a21e395452b4238f + 3.28.1: sha256:985caad36fed7b883a2cd4cf91e556974bcca95fe4e6b7ff4cb64d8d8fbe9223 + 3.28.0: sha256:0789cb0d1478ec3f0a44db265b19042be9dfc18bc1776343c7ea8d246561d12b + 3.27.5: sha256:7b8c8936e55e319b94d1fb71dacbef7617661f76241a4ed16289b5a2165fa62d + 3.27.4: sha256:1d44e119d9836eb4715f42a915a849377f7d6a6881b73ce66d0c95092e29d4f2 + 3.27.3: sha256:5f2ac510c0ec31ec4c02ff2660f2502b68b655616d5b766a51bd99d2e3604fbc + 3.27.2: sha256:f918bb88de1d01de3d143e1e75d0ee1256f247c5cbabec7d665aaf8d1fd3cc6c + 3.27.0: sha256:3de46d8bc30c6f9d9387d484ed62a5655c1f204b1b831b5a90f0a0d1c1ffd752 +ciliumcli_binary_checksums: + arm64: + 0.18.3: sha256:e0588268fc9ab6e0b7a363c4e15ecf69ed2a4cade956ab272745262e456f0e54 + 0.18.2: sha256:db3fae09ba005d6d345858655777bb5c972c9c841f98dc3fad3455d3084dba61 + 0.18.1: sha256:e6556fc7ccd071d7612446945d361c869dfeb423e0738147e0b46b2550bc2bf9 + 0.18.0: sha256:fd20a79875c8089694fb9b5dc3a0bf89d51711f9239637931ff0ace76ce78816 + 0.17.0: sha256:dee29ad27f3958882b450019e2021698282e8fcf8b136c27397798102cc1ad13 + 0.16.24: sha256:cf7f1276bbcf4aa5e6347d5619efe990cf1340d5898f8405931e277a1f76c670 + 0.16.23: sha256:7973302bead01c3f2e1d0f03e2766a0d6e76d3c52c666c750b9871a28b9afb32 + 0.16.22: sha256:b70c15e40b36ac34d59597f2448c5b4e0033964c517f926dbb9654aa07fb1e5b + 0.16.21: sha256:7b710ddc0d3250f8c5d49a4cefb459b98c3c6651da9389d65cc727451fe3c4e6 + 0.16.20: sha256:4e3f50a6021fa8985232cebb0d9d33ba63e51f43f8fe5d657fc3e91179f8b96a + 0.16.19: sha256:4a7a401d671054efb98dc9a8028aea82d66bed0bfc86ff008d823d1200d20030 + 0.16.18: sha256:8cd07955edf821ab72f7b765d9b23c196c0e69189e38864ec2470987c2b234fc + 0.16.17: sha256:3a2ce18f06b4e88944b232fe1ef30678ab6157846628303da56c15e423d609fe + 0.16.16: sha256:934232e6524f0236edc497664c491a84c7599eb909b7806c789e96b72bb92238 + 0.16.15: sha256:af297814428dbcf2da4c6c5c03a359f0e5592a01f882ddf39aef0dcd0542223f + 0.16.14: sha256:f335a6af685d6cc47fe4b53bb3fe1eef4bb567d02eff11dc44f4c33fb058e131 + 0.16.13: sha256:2465d104b4e463cdd01021f04e064cef075dd93918eaf1ef4c6b02273de772a6 + 0.16.12: sha256:a093cd04332be79510a78ee6d7a35f61cb8dc068b7d77441fccef7e1b2dfe36f + 0.16.11: sha256:b118df2e75b950335385c9ead4c59dff977c1e36c845320fe5308d4a2c8ce39d + 0.16.10: sha256:625e880a9a5a9f38931a3e129fe2c811bd4883105b6f4dbe562734d48a082f7a + 0.16.9: sha256:3417584bd63f36617b0556e0f327d45ad35aa462b4f3dd2907603f5c9040fb80 + 0.16.8: sha256:a88d984cf962a07a60bbe3da75494661cf9acd4166575513d7875c960349174a + 0.16.7: sha256:9b6ef0f1097e3937127a05e44c9506fb476ef2cad88ecacd1b2fd9c70de680cd + 0.16.6: sha256:3c36f52012fa3ebfed5c3959cc7e429ed6c3da640a5ffdd28bc0d9818db383dc + 0.16.5: sha256:5d5692970af1abcdc22fcb38aec5fec770483ed4b5c1e17d26ffd4923f07a851 + 0.16.4: sha256:d83461431b5c853888c4213f9276991a95806960a87af64f2131b7e445ee9ce0 + 0.16.3: sha256:c6d5f4dec27a5937814afb2750194d15c6caaed130aabb539793fce42698f860 + 0.16.2: sha256:b5c48449c7d7d80bc537d9d231e1242e92fa0db9c7fef3c5e4198e21b3965e8b + 0.16.1: sha256:07f3f2ba4d772140e46004ee7fa239134acc27afc4f79fc301ee7037617babc1 + 0.16.0: sha256:fe16bcd447fc6fe764ca75712f5832d7504845e9f782684ff09c9f52548237fe + 0.15.23: sha256:9aa37d99a15e72bbcb555d7ed5b88c2ae3a7e6fbc478f9ee402a835ba6b41175 + 0.15.22: sha256:23caf44dade82b5a986e9799db333724845750bebe32e571a356ab9116406f6d + 0.15.21: sha256:346bf2d0d60e11e02c676bcd7cb379cbedd88830188dbf811ad7099f5907da9d + 0.15.20: sha256:4b05fb1661b699edd89f37124d5cd0aa4f5dcfc197cef6a0bc7a6faa3dc119d4 + 0.15.19: sha256:a32521b2add0203c1945f71c6d8a50739946b4f7e35c2636529a5063959072d4 + 0.15.18: sha256:fa1aecaf1c69663bdece17608c6e85f0a5a2c8ee8fe2cbbadf25cbe887b7ae15 + 0.15.17: sha256:4df6f634512a0e426258fbb83d43c0defabe9d91c81480c040af08fa05b4a989 + 0.15.16: sha256:86ed6a2e796c39dd00072e7c141fc35b68d63392d1ac5e183a7ce9d7263e23a0 + 0.15.15: sha256:5c1693ea163b094a92ebc6997b6e678cc8c24a52040c22433b58b419de74b28f + amd64: + 0.18.3: sha256:5fe565f3b98b5846b867319aa76bc057fca37894d80db56edc20e4e809d10b25 + 0.18.2: sha256:1b4bd5fd5c96ab1195cd4eb56841c983a21149c62ee39922b7955f1cd0eda23a + 0.18.1: sha256:c472639d460173e8d807a3f57048f9d1bcdb325e9edba320550d7ec62b72f956 + 0.18.0: sha256:3ac8bd270763e40a7853c73f8c7ec9e49707e1723801884a083dc25469b6b4ba + 0.17.0: sha256:4ba0687ff7d47e182a7328409fb0eae123e64fa6099cd6f8b9bf240c0012ecf4 + 0.16.24: sha256:019c9c765222b3db5786f7b3a0bff2cd62944a8ce32681acfb47808330f405a7 + 0.16.23: sha256:e7cd3b982eca9b6214226536a147490ebb6ea3caad40d5a724daeea0bec5e3be + 0.16.22: sha256:8bd9faae272aef2e75c686a55de782018013098b66439a1ee0c8ff1e05c5d32c + 0.16.21: sha256:f5c4fed6f78b340a6678793c299cc5a8907e55bde9c9e0cc1759c26f6f37db05 + 0.16.20: sha256:8d0e75bf3a867880cb82bbec57027864879775997e3824737e36cf16467d9d04 + 0.16.19: sha256:211c994c9cabe1cb194f308510b78d8498681ee88771fd7c503e259e74eeb541 + 0.16.18: sha256:aa77d11150fac1e59431e5a50d5977219aae6c4bd9ccb051899c2ab99256f30e + 0.16.17: sha256:77391d4c157e26685e030ec97c075e8cf82dda7fb11875ea9ee4df3bcb0e0070 + 0.16.16: sha256:2d493a70e08d0df947a19d6065f40bd3886554a7fad30b02a7839aeee7400c02 + 0.16.15: sha256:20a5296a9eca3aa50ad9bfa061805b5f332df9d25829f2fd34ecd42d0bf26caf + 0.16.14: sha256:65c6fc67cf7cff7d958266642032386b4a9a715c502f016aff1761ec2c736b85 + 0.16.13: sha256:9e7597f97192f3d2cbe61a25d1a4aec33a43ef9c307bff27c3c1e81af0011891 + 0.16.12: sha256:535d3a72771f4b1c732701289dbde74ec9efae2e6b56aafc2b448773bd6d815b + 0.16.11: sha256:f3afc4f32aebeedbdf082c0aa69e243809bfcfba8f60cb1bbf19abc56b68a750 + 0.16.10: sha256:aeb9d7c56108283a9fb9b370ec36b33f28f3126f6c4e6b4176a15cc6b2d3fc70 + 0.16.9: sha256:c6c381044025167a2dec943dfae26887cfa4ade0462f463466fcf82da5df8446 + 0.16.8: sha256:1903abd3055d2ddfccd5a4f6a2a45a00943d6fe9a14c889bf22714d46601f318 + 0.16.7: sha256:7acd60b565428203c3015a3273fae431bad0e833bf465a7460a5d4b432a2badd + 0.16.6: sha256:3172f3ca66df44233f39bcc2c43c4c149ed90da29acd1da44e8efd498828cf93 + 0.16.5: sha256:699ac1b5f1793145477005cb6b7bd0205458057120e660bed4bc617d3457e261 + 0.16.4: sha256:cbc30655a886ee05c8ffb5eff3ad6f92d37f129c49f4515ce258658f9078fb10 + 0.16.3: sha256:0ff241d8c31d9f4a10d570dc2e9c8d35648bd9e5e21242d07e40a0c55c9485f1 + 0.16.2: sha256:9cfb7ee5b1d6bd125174675e8aab6f9a09283cde699b5ac201475784ecb864f8 + 0.16.1: sha256:9c3bb746e554efc788631629932ab00d13979c75799d957f6d3c17219deb6d45 + 0.16.0: sha256:da98675f961833d4ffd68b1046d907b228a7d394ded2abd70a50b20eaca171c4 + 0.15.23: sha256:cda3f1c40ae2191a250a7cea9e2c3987eaa81cb657dda54cd8ce25f856c384da + 0.15.22: sha256:c9bdf99362c16bb63ea44a214e39319d8ac1d196345792caae9665f36fe274a3 + 0.15.21: sha256:89190bb3fdcde892d7a8d3a9718e5ffacd312d2535eee54d93ccc81c2d430cb7 + 0.15.20: sha256:a1a09f3f0176e118b1b00be4fcd7f9f32f27c9587c64b5579d2747d751e72e23 + 0.15.19: sha256:9632fa506d7d0e0298dc5b80b9e05239ceb01d60b124dde2132417a96ba4d07b + 0.15.18: sha256:b10359784d4c194d43bbd1de5d7000f9697e451049008ade5a0754e3c4f7958e + 0.15.17: sha256:ed8edbce96ac7921ee75b2fbe42409fbe381e2f8f896c10d13f864cc52e07a43 + 0.15.16: sha256:f30095e1a0b926d2114b7a419141bea76e950b643182e97e666950ca05a205d9 + 0.15.15: sha256:492279c1f960c79747290a5d1e1b21084a04a93f9e13ab4ae7df4c76fe808aff +calico_crds_archive_checksums: + no_arch: + 3.29.3: sha256:66d49b3af986944e58fede252a2c164251a63f43894181ed7401a6e11dcd8421 + 3.29.2: sha256:1866b407213b6191627c0ce7be5a0d7c14a016823b3bbc2a6898c57be6c59917 + 3.29.1: sha256:17894ed9f7487f1418e599fdeff5db9047374dee12d560114e25ff9147a455c3 + 3.29.0: sha256:403a6b8616c4e97b081d7be27e9024f2f66b2d73a0ea037420a29689205b2064 + 3.28.4: sha256:a296906bd6b38187ba15669139dd6bf8bd26d0b191e9773fa0e85a5cc2d0b5e9 + 3.28.3: sha256:2b3348fb9e022bb6703c460789bd9327d9062c6854262e263fd409ff368034e7 + 3.28.2: sha256:f02a0e99e060850bd9050d4c94d37df899911a5e357e1d26e1b5b79a923bb389 + 3.28.1: sha256:c56f1530e7ded9d5b4afb9d83a7a24da6d2959ef7ad38521813f1c2bf138182d + 3.28.0: sha256:ee721337db0cd847e91aae1cdfd420596896ebcb865575fd913c2f12ac2cdb76 + 3.27.5: sha256:f9cca65b96ab05732ed1902afd0f3086be54d6bb6b47c86a289ecf4ea5cdc25d + 3.27.4: sha256:5f6ac510bd6bd8c14542afe91f7dbcf2a846dba02ae3152a3b07a1bfdea96078 + 3.27.3: sha256:d11a32919bff389f642af5df8180ad3cec586030decd35adb2a7d4a8aa3b298e + 3.27.2: sha256:8154bb4aad887f2a5500b505fe203a918f72c4e602b04c688c4b94f76a26e925 + 3.27.1: sha256:76abb0db222af279e3514cfae02be9259097b565bbb2ffcb776ca00566480edb + 3.27.0: sha256:2a4b5132035dfd6ac4abc8d545f33de139350eca523e0c5cfe4ac32e43fcb2f1 +helm_archive_checksums: + arm: + 3.16.4: sha256:432e774d1087d3773737888d384c62477b399227662b42cbf0c32e95e6e72556 + 3.16.3: sha256:02ba2f3b1524113f49be6df25a0b4b3190010d6e218c8e2b2fde4578a8439a9c + 3.16.2: sha256:f0f606d0806a518b749bd82e8dbfe6a803aa33340215590ef3977c60e366ba82 + 3.16.1: sha256:a15a8ddfc373628b13cd2a987206756004091a1f6a91c3b9ee8de6f0b1e2ce90 + 3.16.0: sha256:73efcd63d1b7f1d9db6afc2e039e03a638fe43d3633735363184692ebc8eef02 + 3.15.4: sha256:aa3fb3014d147e5dcf8bfe4f6d5fe8677029ed720d4a4bcc64e54cb745a72206 + 3.15.3: sha256:77a9c9699c836dd34fca3d9e783f9e70e0ddbe1a4b44aa13fac82f6193da452f + 3.15.2: sha256:2b28fda1d8c6f087011bc7ec820051a13409dadce8385529f306476632e24e85 + 3.15.1: sha256:fa7a8b472c8f311ac618a231218511efeafad306781d11ad68976e0461074b0e + 3.15.0: sha256:614d53ab1192667facce7e8d4e884ff067e5684199a7e5223e8808abc43e927f + 3.14.4: sha256:962297c944c06e1f275111a6e3d80e37c9e9e8fed967d4abec8efcf7fc9fb260 + 3.14.3: sha256:d4ff88f02d6731ec5dbde86a67bf391e673d0d9e87901727fbf62372aff106ec + 3.14.2: sha256:b70fb6fa2cdf0a5c782320c9d7e7b155fcaec260169218c98316bb3cf0d431d9 + 3.14.1: sha256:f50c00c262b74435530e677bcec07637aaeda1ed92ef809b49581a4e6182cbbe + 3.14.0: sha256:cf38dfdead7266ae56662743bda0c78655814f0adeca382d1b07a812bb1a599a + arm64: + 3.16.4: sha256:d3f8f15b3d9ec8c8678fbf3280c3e5902efabe5912e2f9fcf29107efbc8ead69 + 3.16.3: sha256:5bd34ed774df6914b323ff84a0a156ea6ff2ba1eaf0113962fa773f3f9def798 + 3.16.2: sha256:1888301aeb7d08a03b6d9f4d2b73dcd09b89c41577e80e3455c113629fc657a4 + 3.16.1: sha256:780b5b86f0db5546769b3e9f0204713bbdd2f6696dfdaac122fbe7f2f31541d2 + 3.16.0: sha256:fc121590b532d7f2037ae5cdd39d2b56dec96069d8bc613a08965f29a156e84f + 3.15.4: sha256:fa419ecb139442e8a594c242343fafb7a46af3af34041c4eac1efcc49d74e626 + 3.15.3: sha256:bd57697305ba46fef3299b50168a34faa777dd2cf5b43b50df92cca7ed118cce + 3.15.2: sha256:adcf07b08484b52508e5cbc8b5f4b0b0db50342f7bc487ecd88b8948b680e6a7 + 3.15.1: sha256:b4c5519b18f01dd2441f5e09497913dc1da1a1eec209033ae792a8d45b9e0e86 + 3.15.0: sha256:c3b0281fca4c030548211dd6e9b032ee0a9fc53eab614f6acbaff631682ce808 + 3.14.4: sha256:113ccc53b7c57c2aba0cd0aa560b5500841b18b5210d78641acfddc53dac8ab2 + 3.14.3: sha256:85e1573e76fa60af14ba7e9ec75db2129b6884203be866893fa0b3f7e41ccd5e + 3.14.2: sha256:c65d6a9557bb359abc2c0d26670de850b52327dc3976ad6f9e14c298ea3e1b61 + 3.14.1: sha256:f865b8ad4228fd0990bbc5b50615eb6cb9eb31c9a9ca7238401ed897bbbe9033 + 3.14.0: sha256:b29e61674731b15f6ad3d1a3118a99d3cc2ab25a911aad1b8ac8c72d5a9d2952 + amd64: + 3.16.4: sha256:fc307327959aa38ed8f9f7e66d45492bb022a66c3e5da6063958254b9767d179 + 3.16.3: sha256:f5355c79190951eed23c5432a3b920e071f4c00a64f75e077de0dd4cb7b294ea + 3.16.2: sha256:9318379b847e333460d33d291d4c088156299a26cd93d570a7f5d0c36e50b5bb + 3.16.1: sha256:e57e826410269d72be3113333dbfaac0d8dfdd1b0cc4e9cb08bdf97722731ca9 + 3.16.0: sha256:327cfbc7ddc5a3eb644039ceb0cff66394628654c4f5a76bf715ed15b893983b + 3.15.4: sha256:11400fecfc07fd6f034863e4e0c4c4445594673fd2a129e701fe41f31170cfa9 + 3.15.3: sha256:ad871aecb0c9fd96aa6702f6b79e87556c8998c2e714a4959bf71ee31282ac9c + 3.15.2: sha256:2694b91c3e501cff57caf650e639604a274645f61af2ea4d601677b746b44fe2 + 3.15.1: sha256:7b20e7791c04ea71e7fe0cbe11f1a8be4a55a692898b57d9db28f3b0c1d52f11 + 3.15.0: sha256:a74747ac40777b86d3ff6f1be201504bba65ca46cd68b5fe25d3c394d0dcf745 + 3.14.4: sha256:a5844ef2c38ef6ddf3b5a8f7d91e7e0e8ebc39a38bb3fc8013d629c1ef29c259 + 3.14.3: sha256:3c90f24e180f8c207b8a18e5ec82cb0fa49858a7a0a86e4ed52a98398681e00b + 3.14.2: sha256:0885a501d586c1e949e9b113bf3fb3290b0bbf74db9444a1d8c2723a143006a5 + 3.14.1: sha256:75496ea824f92305ff7d28af37f4af57536bf5138399c824dff997b9d239dd42 + 3.14.0: sha256:f43e1c3387de24547506ab05d24e5309c0ce0b228c23bd8aa64e9ec4b8206651 + ppc64le: + 3.16.4: sha256:0ba4375a6dcf6117a8e7729fbed36d9220f8ad98dbc7aabc16186f22917caead + 3.16.3: sha256:266f7698c56a724fddd3a2f2b862ad496c4338dce79f0282fdbc6e23e1738608 + 3.16.2: sha256:32a1b6073064a4a86d2a684180b6662ea202d1294b09ca52a6ba9d4cf071fec7 + 3.16.1: sha256:9f0178957c94516eff9a3897778edb93d78fab1f76751bd282883f584ea81c23 + 3.16.0: sha256:d13a4b87b31a5b50c8d93dd9988dfb312a61e56504102f466a4004e5a3ab8e9e + 3.15.4: sha256:e4efce93723f52dd858e9046ea836c9c75f346facce1b87b8cf78c817b97e6ac + 3.15.3: sha256:fac86a8a0515e1f4593d6288426c99f2b3edac946b7f118fcfe03e4a09523f25 + 3.15.2: sha256:9d95528fb797f6429f7f9b6dee0cf87bf8c71f6470e1db4a51e844c169c285a3 + 3.15.1: sha256:0bfe2ff8b29c1f26b0484261c0fe0d041188b2e1aa5da8e461e44083bbf655a3 + 3.15.0: sha256:bcec19cdad95cae99edce046ccd8090f275e63381ccb6accb4304819fc26e004 + 3.14.4: sha256:d0d625b43f6650ad376428520b2238baa2400bfedb43b2e0f24ad7247f0f59b5 + 3.14.3: sha256:aab121ca470e2a502cda849a9b3e92eeb9a32e213b0f0a79a95a04e375d26ce7 + 3.14.2: sha256:f3bc8582ff151e619cd285d9cdf9fef1c5733ee5522d8bed2ef680ef07f87223 + 3.14.1: sha256:4d853ab8fe3462287c7272fbadd5f73531ecdd6fa0db37d31630e41ae1ae21de + 3.14.0: sha256:f1f9d3561724863edd4c06d89acb2e2fd8ae0f1b72058ceb891fa1c346ce5dbc +cri_dockerd_archive_checksums: + arm64: + 0.3.17: sha256:761ee6db946ff2c8da04e57833dbbca8e5c38bc3f5b8e84bda689b1b7260c36f + 0.3.16: sha256:0ab930b6f7ab87697cd94c954d01e19fdd5b5d65810662effb957c5db49a55d4 + 0.3.15: sha256:39e430378c9c08a1d5056426e3c772ae50416ffeadbe720fa63a853c475fd5a4 + 0.3.14: sha256:12c5538887ccea5ec363337dbb50ff52f3b020c93d65649ee1a906c4ec994bf7 + 0.3.13: sha256:a4a3d18f26902631b8323c6b6d87925f8ceff626b21dbc1d160aca84454f9b69 + 0.3.12: sha256:23520fc42dcdcb9f44b0edb555a5d760eedde52a230750e21227fbb258f514b5 + 0.3.11: sha256:877f635a7005b393f7aab24ca4b1cd7bdfb3b967d055e858408240c86e3cab9a + 0.3.10: sha256:24d2d9cdbb4ed4bda4b0838edb52104ac7a4e2212a0ee05b177de0ae5b6a4a9a + 0.3.9: sha256:f5051002b4f95b0e8fe7fbd5f8de4493350e010834d2a8b647f2b26c45c6c203 + 0.3.8: sha256:64286af171785f0facb72cf364867600b4db19f43a01db49b8b364f5d04aadae + 0.3.7: sha256:8da54563ee7ddee36b1adf1f96b3b7b97ec2bc0ec23559b89d9af8eae5e62d9e + 0.3.6: sha256:793b8f57cecf734c47bface10387a8e90994c570b516cb755900f21ebd0a663b + 0.3.5: sha256:c20014dc5a71e6991a3bd7e1667c744e3807b5675b1724b26bb7c70093582cfe + amd64: + 0.3.17: sha256:5568d571c2cfee7a31ce0b35b7fcc65b96c85b573ee6645151c4d022ed92a626 + 0.3.16: sha256:cc7f181ce850130dc375515c54cd8a27e1e862252abc5b7eade7b4a03ddabd8e + 0.3.15: sha256:4779b7c3663f002871e79ecf6aa8eb48d0bb74df035baecf56b816deb21d12c4 + 0.3.14: sha256:89096dff11b60c8d4f061ee88751c895650a3ef6db5c19d63ab22a1aeb42a5b3 + 0.3.13: sha256:b902eef9bd02529e73a03078a1234c038cd9a12cd86af19970e4f8596f95df26 + 0.3.12: sha256:bf0890018cb339a313b6d52e994fe2628f5b6d5f005cec39adb171f055691c96 + 0.3.11: sha256:b2475988f3b86d85c7835269121171e35c92454ad5f4cd6252183b0fccd74d63 + 0.3.10: sha256:3e19ef525e02d2d1dfd42e8d661ee45b4bc8a49a6dcafd8baa578bdb3a23aeb6 + 0.3.9: sha256:a6d9b4b796e9eff830311a2349d259507302cb3955dd07b78296b91e40e8b433 + 0.3.8: sha256:e12ea6df8228b7d0794c930d32117c4e5a3dcf25a56c3facdf7006289ec6383c + 0.3.7: sha256:518c5d5345085f36d311f274208705d7fdb79337a80c256871ce941d5a7d47a1 + 0.3.6: sha256:cf271d65abee88c0c0a6d9dacb151913bf37d25d45913a7e04b09efe408eae18 + 0.3.5: sha256:30d47bd89998526d51a8518f9e8ef10baed408ab273879ee0e30350702092938 +runc_checksums: + arm64: + 1.2.6: sha256:12c612e2ebe6ca198de676ce75ed557e79fe6109032209bb8e25166c967fe170 + 1.2.5: sha256:bfc6575f4c601740539553b639ad6f635c23f76695ed484171bd864df6a23f76 + 1.2.4: sha256:285f6c4c3de1d78d9f536a0299ae931219527b2ebd9ad89df5a1072896b7e82a + 1.2.3: sha256:4ef19ab21ce1ae5a01e1d3fa5b005e45cdf59f5d3ab32541c9e262cb2b2d3451 + 1.2.2: sha256:bfd3e6c58bd6060eaa725520c31cbc8f6386ac7606e65bfa7fe9084100aa1789 + 1.2.1: sha256:8c0d81c80ffdaab986629a9c787d8468ab41851e7aab8f9617a4c3674e192aaa + 1.2.0: sha256:3d4f66dc1d91f1b2a46713d185a506a604f1fe9f2f2b89c281eb1c5c13677ff0 + 1.1.15: sha256:c680f8c470ffb228944ca80e1a4dbb6768b3ad97057350852e128847f9dd10bc + 1.1.14: sha256:050ee97c266bf7d31e1474568ffcbb2a3ff2208087aaa238c8bbe7e398414126 + 1.1.13: sha256:4b93701752f5338ed51592b38e039aef8c1a59856d1225df21eba84c2830743c + 1.1.12: sha256:879f910a05c95c10c64ad8eb7d5e3aa8e4b30e65587b3d68e009a3565aed5bb8 + 1.1.11: sha256:9f1ee53f06b78cc4a115ca6ae4eec10567999539ce828a22c5351edba043ed12 + 1.1.10: sha256:4830afd426bdeacbdf9cb8729524aa2ed51790b8c4b28786995925593708f1c8 + 1.1.9: sha256:b43e9f561e85906f469eef5a7b7992fc586f750f44a0e011da4467e7008c33a0 + 1.1.8: sha256:7c22cb618116d1d5216d79e076349f93a672253d564b19928a099c20e4acd658 + amd64: + 1.2.6: sha256:0774f49d1b1eebb5849e644db5e4dc6f2b06cee05f13b3d17d5d6ba62d6f2ebc + 1.2.5: sha256:fbd851fce6a8e0d67a9d184ea544c2abf67c9fd29b80fcc1adf67dfe9eb036a1 + 1.2.4: sha256:e83565aa78ec8f52a4d2b4eb6c4ca262b74c5f6770c1f43670c3029c20175502 + 1.2.3: sha256:e6e8c8049b1910fce58fa68c057aaa5f42cee2a73834df5e59e5da7612d2739d + 1.2.2: sha256:a34f5ab4fc1df1f456293c3d797a76f2d41cf3cd970bb49fc53ba94bbc8a5cf6 + 1.2.1: sha256:b106d49c60e688022f5909432a77bd3260f29687199d47213ed87269588af781 + 1.2.0: sha256:3bbb68e49bc89dd2607f11d2ff0fa699963ebada39c32ad8a6aab0d40435c1ed + 1.1.15: sha256:d218e1f8be4dcb1f288dea754faee342375a36f695eac5ab37fc8b7270a78763 + 1.1.14: sha256:a83c0804ebc16826829e7925626c4793da89a9b225bbcc468f2b338ea9f8e8a8 + 1.1.13: sha256:bcfc299c1ab255e9d045ffaf2e324c0abaf58f599831a7c2c4a80b33f795de94 + 1.1.12: sha256:aadeef400b8f05645768c1476d1023f7875b78f52c7ff1967a6dbce236b8cbd8 + 1.1.11: sha256:77ae134de014613c44d25e6310a57a219a7a91155cd47d069a0f22a2cad5caea + 1.1.10: sha256:81f73a59be3d122ab484d7dfe9ddc81030f595cc59968f61c113a9a38a2c113a + 1.1.9: sha256:b9bfdd4cb27cddbb6172a442df165a80bfc0538a676fbca1a6a6c8f4c6933b43 + 1.1.8: sha256:1d05ed79854efc707841dfc7afbf3b86546fc1d0b3a204435ca921c14af8385b + ppc64le: + 1.2.6: sha256:0d7fffba4f89920edd3246afd4f07b18a975d0d97193ffae418e8418c236c168 + 1.2.5: sha256:3764385971ac719535425629e1ac4d451934392993779ee9e8e8ed7566715f5f + 1.2.4: sha256:141fa41c1f382483ccf374827f99c7843414fceb95e8ceb710aba8bac984d016 + 1.2.3: sha256:6d1b771096000a14faae660465faf9626a76afe994cbe60581ec4eac1718f12d + 1.2.2: sha256:9af46fe0bdc654c72593a937806ca034ffbbf4f62f25c1de7a40b5b0f4374de7 + 1.2.1: sha256:652920e145b461151b7e87b28b339594e62129cfc87370b03651a37c39bbc0df + 1.2.0: sha256:0bd876309958ec00a0e86df3f549f025ad7ae32d981536c1a2932465b479be70 + 1.1.15: sha256:b4c8dbbd4973b1cc69fcade012db690e26e0b354d5fcdf04a12ffe972d5ab098 + 1.1.14: sha256:31630474455c4208594623f1337a06556c7fe42d3983000ca800ad3bef6d8164 + 1.1.13: sha256:4675d51dc0b08ad8e17d3065f2e4ce47760728945f33d3092385e792357e6519 + 1.1.12: sha256:4069d1d57724126e116ad6dbd84409082d1b0afee1ee960b17558f146a742bb6 + 1.1.11: sha256:e3d1da41f97db1bb7e9a8d96c9092747c14ee53bc9f160048828e63f3a2d0896 + 1.1.10: sha256:94a091c06c363e4af7be398dc31fa6e02576d5ecda6de1cbf3a08fe8662bf678 + 1.1.9: sha256:065cf4f84b5acc0acdb017af2955743dfb5f5e1f49a493eea3e8206f33bf6fe6 + 1.1.8: sha256:a816cd654e804249c4f757cc6bf2aa2c128e4b8e6a993067d44c63c891c081ab +crun_checksums: + arm64: + '1.17': sha256:3049017b99208f5ecd15c1366f47a77dace87f42dccf317ad40a07f1a867518c + 1.16.1: sha256:973817340e6da12c90c751b011c797396940cca965cefa74557bd1c0939f4042 + '1.16': sha256:4595ff16487b16d2158fa8c3452bc0e1ecdc177ab2ace40fc02cd6e49838ff67 + '1.15': sha256:2ed5fe6def4c1d57f219747bac5e71cb22312ef026fe63ed8e3246a4dcfebe13 + 1.14.4: sha256:308f8719055de178897f66cbb72d6a02567050ac645dd5eca52f48de347dda6c + 1.14.3: sha256:0486629e1599c3bccded279f6555ff22691958cde56203ceca099af6f2407263 + 1.14.2: sha256:409ebdcb4935b004ce0efa8ada4aaf8d4dd63b77cde1d0acdf55664c168acbd9 + 1.14.1: sha256:25f85c85b9ae15de589ac02d2b766178967d29122325f9479ab068534b7a9658 + 1.11.2: sha256:9e1aeb86bce609eccff46a8b976ed06994bca27d639e564fd45756786c4d0123 + 1.11.1: sha256:c8b0d243f6ac4fb02665c157b5404e5184bdc9240dbdcdde0ccef2db352ce97a + 1.9.2: sha256:1ad8bd3c1aa693f59133c480aa13bbdf6d81e4528e72ce955612c6bae8cb1720 + amd64: + '1.17': sha256:e9512a3e034e781b2396d068fd24eafcd5788e410403da886df9dc8871d504a5 + 1.16.1: sha256:7b6f1791fb9b2c49ec959b9384b3c4e2ec8c69945fd5292a179d23eb62422eb3 + '1.16': sha256:7f53bffd6b0e216f8f6d6472bb73dc4c6c4ea2c2e7342c52d4bee2972798ce68 + '1.15': sha256:f02c66dcc38b9d06f19a92dfb5ac831aba9c33ae48dbf4ab92d7680ca1140172 + 1.14.4: sha256:4f170aaa10d2ef02560cfb60b67ddfa1a83b1b4f7018227e9cb23a6af3955ec1 + 1.14.3: sha256:80c5ab9422d4672f650f2bad3da933568349b64117d055486abc3534517be2af + 1.14.2: sha256:4d3a64961ea9e6a1313ab807f86a17bc6ebcecad2df84a120322fddebff00bcf + 1.14.1: sha256:a30afd16bbf7eed9d9ce662062f64ef9fbb5d7c76963668c33e90a5693941fbd + 1.11.2: sha256:acb62839ab8615f0e2485e8d71272b5659cbe35182eb24c5e96bd213240567fe + 1.11.1: sha256:ca8c9cef23f4a3f7a635ee58a3d9fa35e768581fda89dc3b6baed219cc407a02 + 1.9.2: sha256:2bb60bcd5652cb17e44f66f0b8ae48195434bd1d66593db97fba85c7778eac53 + ppc64le: + '1.17': sha256:ca8ee0fabcac57b61b80f6c234ae20b3b9821433fdf1a6306be5defeac11930e + 1.16.1: sha256:9590ce79697c5509731f8e58d1733b7051c36f92104925221ca8bda800afee41 + '1.16': sha256:fc7199a2faac1ca0e3e58dee4dd369b9065aa0d95f3257d8803e521213f1bd9b + '1.15': sha256:dd0aad6140175ef83792e601c8e89cf66813486e9070aac7f39cac040283d4fd + 1.14.4: sha256:aa7263d3c54e478158ed5a70a435208096e434e58ccbc2a334ecbbbc384eff09 + 1.14.3: sha256:b3304ce1a983e4e1abd4b2bc59eedaa188299be838bdcd8b376f1f8d489bdc94 + 1.14.2: sha256:1cf8f3296d1f6ab4189da565d2ac3552059e8e455cc665b913f4b5f3e484bdd7 + 1.14.1: sha256:a1935fd9a76f0d68a3393927f45cf5627c20915046a254d4fd27531865617b91 + 1.11.2: sha256:467f2c1e95f3dc4161d0c0dd1d76601ab3de6d84460d17e1a6647474e948f264 + 1.11.1: sha256:723528913c24fac8fc7c4418b9780090eba74ac2d82435c673dedc3af39d5abe + 1.9.2: sha256:42813b5bea2137bf9abcd1bcaa098a7d61fbbffd2a35d9c9f0f1ba79fb74eb5b +youki_checksums: + amd64: + 0.5.3: sha256:173b8998cd0abf22e38e36611b34cc19a16431b353dd893e3d988cfc77b4e6ac + 0.5.2: sha256:361c7187939eab02039fa4289d33158fe4bf4d21ab8cc7139ace8f52081524ba + 0.5.1: sha256:554dea487dcb54b34fff003fc047458cecf073337d20b77e69c22918c2986aaf + 0.5.0: sha256:d7ec0cd5f69ecd96b41df13cc38a970ab217aa9c4b2262ca4843a68595975d91 + 0.4.1: sha256:6f7ea3651b284a808f344ad40f9f8315b3b02b76a3ee6c6af7bfff65753284c9 + 0.4.0: sha256:7cf3ae3d1be19a731378b289000cb36ba9cedcbff8a0cabe38edb782e8c55f72 + arm64: + 0.5.3: sha256:a15dfe9a1eec2d595b9a972a8a0fa1a919ee3d3523e77ca8c22099bfadf7e88d + 0.5.2: sha256:8df7e4898088e6fcf942f2e145b0a50c1ad81f5109044e48897c0af9bb3f83e6 + 0.5.1: sha256:ed8e2f5ac03553d0a8ac641339a9f94f42baee652e2afdc1afae08529807a796 + 0.5.0: sha256:1e504e01caf396e8ab87de24bcdde0adaf6251ff2a3dcd0d8622cba0132caadc + 0.4.1: sha256:c954397353340a013d77d63cda9b074e5f1de57e06fe6f8d44f508b5dc03c998 + 0.4.0: sha256:0d897debaee98a937188317304a9caafb0da5bf798717aefedf113c108f73263 +kata_containers_binary_checksums: + amd64: + 3.7.0: sha256:bebf218cafdc082476c7dabbcc5439aee6a41d6dda24dd3cfffbe0a6ae94e23d + 3.6.0: sha256:d418859e123d04edd71e79c8f532213e5281ec7170b97cdfe3cf85487187d60f + 3.5.0: sha256:cd0e6a70828db3f9e27390f08c863edda36824c201c35eaa0a4c7498b7e4c9e3 + 3.4.0: sha256:13f2c2442a4bbcafddcb4739428bee95eb26600516a96e29576fa0ff31152e44 + 3.3.0: sha256:72e29c7b3ee325e0049bf694bbb843ed07c3eb0a05d89c2b3a1635241e4bafe8 + 3.2.0: sha256:21bb8484a060450d6522f29bed7d88d773c28520774eaa2c522b6f47fd12c4a1 + arm64: + 3.7.0: sha256:23e0d5c4e38c6944729a11c631f947abc5aab19427a44d8691bfb9ad1c38b831 + 3.6.0: sha256:38277c8d1b9f3c4ea1089338f9251238551b88a5259e8e8ed45fe392ec1ed4bd + 3.5.0: sha256:fa4cf67d010244c4f8d0e6d450d04e28d1bbce5ad1a3cbc0154adff628d56c0c + 3.4.0: sha256:f961a283a9da3c6be8a6442842913b036cf0354b9e99d5a8d7a5cc9d923bcd8f + 3.3.0: sha256:5437f0162e08154260c58642f433d8a9154fb6d443ca2c1ddee675154ec88c9d + 3.2.0: sha256:40627b7ac677ce0f5ffc73b32c1a8bc553e75b746b6cdf8f14642ac27dac3148 +gvisor_runsc_binary_checksums: + arm64: + '20250512.0': sha512:00e9edeb4a9ae702c9617a583f2978a042f20a05807acfa992bc76de4fae2e6e1e994d34ad6f21c826d2cfdea89f6a163c69c0750cf4d90135146438587a3a8c + '20250505.0': sha512:1611599c6788d3c3f7495b5054aaf9ec81e7a714061582f913359886452fa14f8e65b2bd2d139bc24b5955749167f0db03aefaa6b3ae175296b56814f53d7898 + '20250429.0': sha512:bd58d212088263ad998fa62dbc7f2a8f74ea3914e8a7a319813c3e461f297dcdbc3e85069aacbcaa8c2e573b0e7b17d730d21ab96f8c3ca9516bd43acc070330 + '20250421.0': sha512:647127e139c77d5d360db915d64a21f461fc11ea47d3660feb48952a70639155cd8c19e2bbe16d190a1666c6f689c45bda2aa5d3440596ef174983fe41d8539d + '20250414.0': sha512:d1ba68b20057622e58e886f472e021a473222590c936a86951005d7b97366b446ef0342b91457ffc0d7e543d54c9c06a363f2883bdd6c594799c4ca1091dabd5 + '20250407.0': sha512:cb590f72b0fbda45e89a2300e9247f12ff295a8c52653c8cf815c662d3fbbc774f9b915cdd4fad59e30694d8cc8737fe2a1a8186ab5136f7701bd6e6877a1662 + '20250331.0': sha512:d78302d8491b7da915c0eeb23c1558e05760ed1388450a357f953620bd369ef2554fdc6d90b235de16f173df7ea9a9160d453b71801528a495ed98d34d94a7dd + '20250326.0': sha512:6946a6a82990fdf39312f63fdf421cec048eea55019fe9ff47df9a5988ee1a8340976d187623201a9f6fd44e3b23cadcc413f32364861382c907055d774c46ae + '20250319.0': sha512:8bc6cd22af7e682920d3de134836bd1b787379bf447ccbf554e9f3fc7272aa6650dd9aca52cc36d85910c8bfe40c6d76e11c40518617b91868aeefeb938cb2cd + '20250304.0': sha512:3e069ef4a4879747ca044b23babbc231367f5dcb36f2755e297d9bef8b8a649f6a05495b43f662a636a92d81312d0eb572663e34f164010b23dda7a707bee3d6 + '20250224.0': sha512:474ccbb94bdbe5d4215b05c27db922d9609af16dc0375bc38d32b0dd07e4f8d1dc2efacea80349175c24b5ed31a2ce51e6735b167a6c74c0a4ee93143d2bb286 + '20250217.0': sha512:3f7e01042a62a800efaff48e9faadfdcfa65e42469795bc0d44e42762b476262e1763fa9aa451865432f077a7d13117c0a520947c0954b489193967e1541441c + '20250210.0': sha512:4581b61e0ad0d30d6addfef43744ec58b40cd78cf85a0865741af2c908fb36ad8a9df6fe70821913e24e1ba4a5a04ef0b2857aaab58f5b1979bf359c9fff3127 + '20250203.0': sha512:4b62e91e1c8709be1aacee8fdcea60fd8a0dfb36faff5ad2c8b904cdff3f0e04d06ab046c4a29802e4a545aec8f7966b074adfce2cf17b70faff07001e567384 + '20250127.0': sha512:643734cc57d096a4567a146bdd96f17e4308abfd845b5cb59ba5e71cbd07ad7cb190d694dc23333be50805a74ec1dab37f2e0e9f7012b0dc8c688566697f9b54 + '20250120.0': sha512:0ed16fa061c8724f38b5fc327aac51f4be5970bd6327eb74be168243ad13c671d55efa92a002125f3ee57bfb02266854f4ff338e94678f8a1eb05b4ff98142cb + '20250113.0': sha512:7dca967b4fac3dccd2669f44d6516c4c9f86f68bf42b514bb9739690afde18ce35551a5bb4ebc21f9c22d1714b6e04eeaefc423ba186835bf6647bccc9ddbbae + '20250106.0': sha512:6165ceaed325e4e325b3ff4f312e03ecfb60f577b7a01a4cf3be6dc58bc4294e54569c18543278c022a337eb06a55d25dc0ac3f237c56def23d5e7145ddc0edd + '20241217.0': sha512:bd7a1f07f43d9f012882591d794fb81f4d92d156e32d7da3b9720817b7cdde25667ec09d76392585ef5bd705fe106c7453ec99c6ad6dca85eb488120034cd6f8 + '20241210.0': sha512:9917f5ea954542d7ab1ae802d865da33d54406d445166df4a1c7986292b685b634331e39f69dfdbaaaa5f74fc1628fc5d00446a2d80a49060215863d711011cb + '20241202.0': sha512:8e9169cc221a666da6521877ffd5ba0259f4047d76b18d13c677d08c33491e937775beea702248b5fcd084560c2053f9363dce00f1245db329545f2a63d256c0 + '20241118.0': sha512:3fb180c011404a1a74dae0094ecf50ae4aacf2b8f23e28d37739df23fe0e298428abe9daf4ecab3d4de9b7208904bafa692464c12e09e913a28925358718df44 + '20241104.0': sha512:89cc1914b390e206cfd60ece8987338f501e35b771e9d55f775a392508c1c371119a937f0bd6c76857a60f73010b29f4baf124b1047d57e0a8bdbfb046cfba45 + '20241028.0': sha512:ad81b88376802638379f2d101f8bfb9ab4995d8080d05911c339f1681023c4f1cbe17a0e49039307c51e4c775182e750768a003f5955ba1f3219efd1e87b49b1 + '20241021.0': sha512:2e11d628c1f6209a5023d34bb9c8cc515a7a2f2acc11a46b79c8c6622544991e105ba67bc0ca3ec79845d6ee78ed9bb2cca6e8dfe8eb5e252a651904b745adb2 + '20241007.0': sha512:e3807ab44a473c9c856503d97850023c84c174b375e37ed66ea0c791789ff17805c6496b64194fa3564614f7c27e2f90ce38d0bb7de794edce280b5f2550dc2d + '20240930.0': sha512:bcea2ee13647b4cc9e23adbaad7bf49d7f8d7c5cdb8266cf0ee05b3f1298d5bc90f0124490ea6e4372a39840ea4aae5236cc7fe47bacbe5c154174a13c6959dd + '20240923.0': sha512:e8122e236e7b220bfa64081e0239becf40aeb0eb58b0b0a88f5c1f49afb5b22d81eb469acd2d1a8fbe7b3204de296a00902c0d4c5f0707f74a5bf47d6165d179 + '20240916.0': sha512:6931f8e09804c8042fc755c88b8957af3cf5c3ebf5cec3d3d9c11229bcaf4123ac10acb84e75dfaa22b25132e7a8c0c3fd25af4b1e255662907249ba1e42a284 + '20240826.0': sha512:a4e25ed9b1d09875831c147078901b6e0ba546d909d478a7e3dab16c0f9597b8c01033f8be6585eb6909f5e37770593067de195339f9cbcbcf9f3e3b47a15606 + '20240820.0': sha512:09c598285396e370ee94fb473ee89fa86de7be4554e210c7798046a2664aed6011ee31c60832c9f7b3f8b850a10fae44f7f2fe14f43bab5639d7cac75ba21960 + '20240807.0': sha512:1b463345d6986810152f420b45f48cdd5b4a28cc07820094daab7621ac555cd2c8a1e9dfa7f9b2952c6fe3b41acfee0253822f62c8de9a87048de627e0254a01 + '20240729.0': sha512:aa7dc806df320a7f88a65a54171ff2268aeeb1a15d6a2a4333685fb37123f54fb95ab6ee4fcc6745f303853241e258b28c7372addac82dbb84f8d1c6d5f8ca0e + '20240722.0': sha512:7fa0f33acaa6fc93774c51353cb8d5d97f4fc531e32bc933d85a28b8afdce4ff8833ec21556947303f38f619a98272b5a37a543114b348836d0846a8182c3f8c + '20240305.0': sha256:b8b54b45fed2dd1fa14decefecc68c8da605b8abaaee97a0550deeee4afc427f + '20240212.0': sha256:a03fb515df9cabf1c618193e9ed7400543c0410ab7107d1ce291ebc9212521cf + '20240206.0': sha256:50b637dcb7c1b2fb1c1ce189a48ca6732d4b5a5c17ac08d5dd22d33b06fd31c8 + '20240129.0': sha256:d2ecc989f27d40a0e7cd53f0712fa91405b1eef2cb466deccffa41a7f607bacd + '20240122.0': sha256:ae9507f4ff950dc315e7dea2c4b0086dce66b88b8c8bac2008d8e754bac7af7a + '20240115.0': sha256:7b2ce18408212542477c31cc1bd0ddddf6fbf7439d57e56f6884091f62c81cd8 + '20240109.0': sha256:51a1b299997834b902192806def688b1e23ff6b14f28a9ed3397f3f6572a189a + '20231218.0': sha256:86262a78946deacc309c0f08883659ee3298c288048dc30955945e71993c81a8 + amd64: + '20250512.0': sha512:981a554ad63f7ed082a43be646b8e910481e4bfc837c5ee5dd5a1353a47b0ae337f9b02700649a542db864ae35af6981e6bdef86c6a48a5e47dacfb97be9b7b0 + '20250505.0': sha512:25705616c3cfc82bb5772e815b2b6b030664dccba7a0db9babcfad5de46d16ce8bff8cd9cc11d366da4acd0f01fb04a0d95bbae070aa923f1492d2f142f271c3 + '20250429.0': sha512:b91d0351907290fe159cf041dbd332f8d2d4151d6a7aaafe161cd842452551b98fa1122e195e2cf42801eb8ff38716270de4f33331dde784cbfc452ec1e368a0 + '20250421.0': sha512:419f80c01cef46aaab0a0eaf9be4bc20fd3aba94e8d0dd8ceacd3b166139d5bc8e701964feb11bf6de7a4274924692a7d0b5bcf5de34f5dfaeec57f7f1ecd88f + '20250414.0': sha512:cc629d16ed0483bfa42ec270f409349f02f3bbd27db1fa384c3146cb54e85cabbfeaf920d1fd189fcae2ab11a54f9ce481d3c4fb306ac18e035943aa02144fbe + '20250407.0': sha512:097259d6d93548bf669e21cfec5ba6a47081e43f61d22c5d8a8a4c0c209c81ac9c4454162b826f98cec49e047bbdc29c270113ab6db5519ef3e6a90f302fa47b + '20250331.0': sha512:21b623afed5dfa19c4f8d78dbd28f131d406f403dbc8394c390dcd86803fec6157be35b3588bc2b210a370947363e4723ef7030d26c2fca08bafa278017b0659 + '20250326.0': sha512:1bc7c309c6400f1a700d7bcc6901db632a3e3252ff1313725b9b538dbba8e974fb6789dfc2427f98f70757a4125a29b87c6bf80dd730fc6d07e330bdd72fda40 + '20250319.0': sha512:ffbb13d965f7da7ef76fdee02ae8473c28252f896680f589f8363914ed9fc0ccfb21ec616595354baee60bdb06847c86b5d6df058f498f9c9bc0e0683fdd335d + '20250304.0': sha512:b43e386a95dd91f6c5af72c303be8d37b0e0fef60f199916b21760c4e3582865c483bb86d67d60e68342f7512da73bfaa270ff06c5421912ba8c84f272ade48d + '20250224.0': sha512:9cfff30e4609c0b6fd9719c087827fc9527b2ed64972242937e9c178e85ab7b63ae4a7262e4423a6e7965fbf5c5340a4e536adc35e06493ae9a4aa4d25884f3d + '20250217.0': sha512:8c61ddb4efc93ce8a6e0da0d270940912db3727dda391d1ab4b8bfaa67c42e5b177195233188858a800d0e8fbe01a4c500aefa1382d8200b15e6f7e84f91289e + '20250210.0': sha512:4e54701b43949e84e9b48ea103ddfef65b25384eb51de1e8ce3a08c126f89d1c127bbf5986d2709565f6819839bde36eec33a54d95099f98ff6caeb5b6ef7d32 + '20250203.0': sha512:200b6a62e3ac40f41363f090c930a8c6bedf40e482e790e60f8d05430a2b92bf76f7b8b0ebe9555b4302256b0e7d52276747d8ce177c555891b09936ed1a9513 + '20250127.0': sha512:6f49799434adec1b23c6d6860fe4da3e290b7379a96ba08701b38f9e7cc2c409701c822d310a8b61a8c5363ac1df3f796001e9c8117f976de93f6f20f9dd6cb8 + '20250120.0': sha512:910ea38bb872edb474429576b6987525edd26fb9d09ccfe6a63dd5fdc05c9f550bd456b07216f4cb8d54899ea189c23b48cf9c6f91c7c4eab4f80972733145f5 + '20250113.0': sha512:222e697c215941890ca1f3381029752fcfc66522e11595f59069f91625e49ea30157a27a8b13bc88ab2c65e4cb4c47a09d7c5e020e95f396eebc6d3fca166625 + '20250106.0': sha512:fe434dc9ddfeaf2e333c0c77d7946012c20a09f125d6bfa9a08c54dd9c237f0da791c5c0e8db4052fd45f2f74a95196292f64824d98e9824aa394c631b534b09 + '20241217.0': sha512:fd079a46cc284608f2f0678f6fcdbeebbd4ab886a09748deecc7a200be2de6c8e66590b96fe7ec43cd0a91081ce7a0330c112f983d9dc6d395f137d5b2641071 + '20241210.0': sha512:f92f559444dc9e6431e84bdab1075b985fedbd6da736b1bbe940aa882e4ad960e79c1d0bab9b3b39bd24e575f7b1fa56d1c35f01aa84c5d1dce960225a439f3e + '20241202.0': sha512:f084c92f1fdd24d8685ed0bc3e255bdb867790dc3144720f58532b9a94071b50af795e163483d9f0630d4df009b2ec1d55c7d948651deca607eae671680954ad + '20241118.0': sha512:e11a76758f4bfa757338d6a0fb7cc68ec930f41f6cb70ca55ade0b26c31c9784f85234216712c12dcbb691b4d5a4c12ad59fade70e34c94cb450e89514629ab9 + '20241104.0': sha512:cc7377e0edc89e1dc11b6c4b678ebc3df4f356baa6a0bf73b78fbb1483694b378592b731b7b27900cc0035ed747d6b35449cdce25bfb7e3a5be3bb11806cf5f7 + '20241028.0': sha512:c8ced6d6524ee87baf18a19fed7fa6c0d1c09cd7915c576728b13a1af63d0ccd813abafb8b50a0f661c6a816d2edee1ac803e1b1de8b656bbb6eecb9de3160a1 + '20241021.0': sha512:258b8008b52bd317e4f0ac676298b497e6986c930f2affa34cfb75659c93135447ff572691a4750c32250d5df30479bf368bafbd5d7bbe6c3bd8473b861d329e + '20241007.0': sha512:4c14a5a1d41ed505376feba6ab90dd0cff8444eb1a0b8c735febec818b84e5bb33b4e7c9b800a0bbc0d75acc73e1b97455e1319a12cff60e0a40b0db3a8b5f12 + '20240930.0': sha512:96470e02d2968a874cd4e2d86526317062e33e1b23059b45fc742a4420f57f4e32e65c4fe1cdf9a7006d1e46c1742adf870ca1a90fd8ce7136fd0db6f70d7d79 + '20240923.0': sha512:20d1ed72258fb4ac1b5103265b9332b52a7eec2065cbc5c9def3470dfdebe1e95c17de823b60e0ef791318044f7e43203fb4fe861c88f3c8a791068fef6fabad + '20240916.0': sha512:d229a0df493c358182b827b2751ee0cdd46d9b486fa410639e5c18dc4de38f18e6fae823c2a868354929ffc494014406fe42543b6180b2859d07d7706a2ced6d + '20240826.0': sha512:f8989c6cbf5139f10a33a31fa4c9fa4ad2f4752cac667ae96e8e4fdeb87504e063981957420dfe51ec26442e602a3103221ca115408b08295edab7b326287e34 + '20240820.0': sha512:0cd7cade5d6e0cdd30e9851d7ddcabb754704a5469ec1e2a43bbbfd4d0a257af0f54d8c3e653bd42b2fa39575ef0630d10f819316953ac410b6bcbcf47202d94 + '20240807.0': sha512:058853fa657216499bdfd33cf779b2570c8edb408a9eb816e0c87a22d30eedae93d18ea61fda85ae1fa93523e483c380164abe680f9018c27ee352a9ed7f4ea9 + '20240729.0': sha512:2d6abd9f304f0c8386c79243b487b16e59b7a71362833e445816f14fbb040b9df2524af84937157e554ba9229553195b8c419abbef77564fe7f35f6403b8a9e2 + '20240722.0': sha512:fefa600b2214ac951c22514bea0ed002e382a593b0a28e6cb1bbe0f7611ef354dcebbddb16d5aa0ef9d623c8dc527198987984dce9300ce09dc1ad961ffbc9d6 + '20240305.0': sha256:3b949f7fab2c7d3d75df09fe5f170b46951e62b8833dcc4abad0a4d6c12f41f3 + '20240212.0': sha256:da5390680d18c3f98f1e88cd7363f97de42ed63a767e61d476b1740b0918b93c + '20240206.0': sha256:996a8e855c1d54a7dcf688d52ee698fd714f0fd143c42ee793707e7f4f18124d + '20240129.0': sha256:b7765ea92c0100fcd1d03c7b23073c9be9486350cf38ffcbb72eb7915fe26605 + '20240122.0': sha256:d184712583d543b8f56a28e8583a1fa55c7256e77934123fe21c621e0d9b975c + '20240115.0': sha256:9ae176da972b288880e69b1a438052eea2c502b6292aea8a1a33fbcf65e135dd + '20240109.0': sha256:f32810820c81a4dfe570080c06c5dabfc1be74ec0d5da659f93ae5cc1fc5c098 + '20231218.0': sha256:c353d36a134dfc2fab8509f72a34abf6a761603975eb00a39e4077c41aeaf31b +gvisor_containerd_shim_binary_checksums: + arm64: + '20250512.0': sha512:43daf4b8b0e094ebf2cede8bbbf89ee0695ff31924e140bdfcff529296e8f004b457485b9f991ae9ec93cf6150535e297db00a92be8a054589b3316841fbc056 + '20250505.0': sha512:42cd72f9b2011a8ad166d9dc246fdb46ef602aae43127373750a7ff65be84f8b300c50e4977495ce59670af5fc5f92c3c5ba96c5d751cb4e6e2fcce373210e06 + '20250429.0': sha512:9a9a2c351789e6a14896ec5e56ebe7ca1dc7424087d13c175e38a4522a7e6f1533ac8ef5aeea0bcbd554cd5e4d6b6d7ac3df2dfebcbea3e7164bf00fa823c310 + '20250421.0': sha512:c86577ddb8b7b46b5b050000e242dc09bebeffa7cb9d21acb84c4ef896cfa340f024e2b9f463fd4f7945683854c524f4a45de3ff3917f4ba65552cede4229974 + '20250414.0': sha512:33b9c67bc7b73ca49154aff48da52029414a707b6a3a25eb4f71e861a94dec8fce220e63a162841670ddd4876f45b0e39abdf9f8c3235019c89f209684d3007d + '20250407.0': sha512:1c3838e10c905af0cb52697712bf6bd76b94c9e9d3d07a7643cd43dc2f8dab03b4ed4693c117e555e07a158e04ee583b6b1f1cf2fb9705244ffa5fdc4af67248 + '20250331.0': sha512:083aee56d7c0b6b0a5f609507e2a5f73daa6e01be72cc2463b905b470f9e8ef57eb0bc15f92b075fb863db54b6b51b569bafa0009eb0fac383f00c626eb33b1f + '20250326.0': sha512:ae89ee8b18f42da15f02c4cb5633679f21bd7e865392b57ab8fda215d3775caf04d447098439826f3257dbde28361febcefe89a43937db0dfaae80b4f914686c + '20250319.0': sha512:a8d6b57941be358156ffe729a92df48be3d4f94d3b2c61e19a1bff2dd69aa1220286599b2b2adf456612ddaddc8f812fca82a0aa1571d7ecc07339b4f106206c + '20250304.0': sha512:3e663aa9fb30fc144ffc02eff1e2104ff9e622dadbba73176933ecacf94372d88dea15e18bbdfb9233224bbb03cdb7fdaaa1ace02c1a7feb9c07b0c0571fab28 + '20250224.0': sha512:6dc610af5a9d974ae416bc4b37e066c513d63566c1f2db157acc61d73bab5e3e589671c111fba2943b88a6cef344f930a2dbc64533ba828c3f2c505a02b19f9a + '20250217.0': sha512:6dc610af5a9d974ae416bc4b37e066c513d63566c1f2db157acc61d73bab5e3e589671c111fba2943b88a6cef344f930a2dbc64533ba828c3f2c505a02b19f9a + '20250210.0': sha512:fa116ab5848e18bd374318ae58f93c7b0b443d85feaa91f05126b7099c12c7eeedd01eba98e0a68d2747d7a44dda23836ed0798c6b4c6c9b634f8b46ae2fb199 + '20250203.0': sha512:0f0f83b7db96b188b6eb26e64f8ccf1324f02b2350001c1852fdf36f1ea4f0407e01c35743a8d5337ffd34182aeaa536cb809ecbeb7f06d627ab8e242a6006ad + '20250127.0': sha512:14358e28bb54e2af201e6b9e6e753a432e8344e6b3eefda90d0525a7f7f428054bae050e5b7339a6b52b28d61e6acf83f1c3e5d4ef9f1025a04e23768de031c4 + '20250120.0': sha512:73c587de9a32bb1add93bdca7198570b5e524ebf4c917ad841eee9ae51e71070fd096d6a84583c4b006a2a0f4f1386ea27daa58d6e6ae685f72a6ce248cacb06 + '20250113.0': sha512:c03377858b8d8503f70ed391b387a8c11b19c2223337bcc2d876e7265b12227d27618dcaa6e727c23e6ca77690f5b33a85ce08c209c1c0ca5448af37264d109b + '20250106.0': sha512:0b75574ec22cc79dc22b962113c6648919111b65fad9d10f804cbf4543afb116e6158eecb1ced5b41a59450f4045077f670ee3465d5298981861f1bda2221ca1 + '20241217.0': sha512:d98c7bbf8f72d81bd0caa4204c015689a4c1a6d2dcbd38bae5ea3115e6ab440ba9220879d4410c75cee46f292b5d0b181cf61e84c75ef7612f1e9394fab67929 + '20241210.0': sha512:109502c35fcc1d55a2c1ecb4199abd25f0684f8e9bc5f2f8f2c5e52b038e5888f56f2dc001e5d813e5adec399a0974a2b202ec4ec5d4d175b74454dbf19c6b0e + '20241202.0': sha512:e5d6ab0906460b1fc8b0339e054c8dd64e3d7d38511fd0e153e3ad5d3c2b5b8a08b9fe24f4045a1fc1a7b56521ec49b3269be69f6ed3ee6f9e6a98f2d7a0b401 + '20241118.0': sha512:a4cb64c5a5449a546f9bc52050ea8dcffcb36af9b76869c56ca662ecb1f83103e2a4ea7100baa0aab002d7c9ac9e834a341fe8020b8032eca30058693dd45ac4 + '20241104.0': sha512:c24f4ba4a08eb8025d204cf83cb0bbdb72913ac63a5e91f600e66c3fcdb7f97817056e8c9045a3d47187da88f59e27bf417e92fbb12b593d42c633e1f895fb24 + '20241028.0': sha512:46cd2ee1d9bea8a285ce1440d95757669d054f7e031781cb22494dbafda63886214d74a28cb9d4928cd884517d485ad5b5b6a376f650a33f03fcf828dd5b3f4d + '20241021.0': sha512:13cbb1399fa8d5c7e074f889b1899abe1fabc7d17a2d39280ecb8b807e17293f30df33bc537679c8265ba228badb33a86d842ca8598c76585ee5bb2a90951371 + '20241007.0': sha512:cd7d19c16a15877c18ddab638db22452f2e58c02077116773338f84acd57bf8fe2d9d4401ae35e3cdcb1301a61e560c5793320754fb53645bbbaeea4944936bd + '20240930.0': sha512:e66d1065f68ef48dbebd69650d4a9faf405a9c790432bcedc00a82b38870ced77fb744e8c78c5d466ea4fbeff3375d5265f08f0c777506118122ecdb952b7277 + '20240923.0': sha512:12deb4784178cf19c9d8df4b2a8805f5c0acef5ddefd1ad47fd0e4ca720953ff2f8374446abb9a1cb99b21e0dec4dc57dbf34d92838e6d40de9676d20a012731 + '20240916.0': sha512:a0c22cdb8dda985c82022503be3b69164bdc4d8a706f6819e969895bc9162e96ad88cb8e9531e88552843a0271964d03fc141ddcd4f3c765b344afdfe77330fb + '20240826.0': sha512:6ac8701f71a5447575d386fea34d478ef36ca0f0a0865976625b4691f3fc985a5e3dc740aef1ddffcfb0b1634eb79f4cad1071b29e006bc595ce006887c3c88c + '20240820.0': sha512:777a2758ecc5e9d0fbaaa2bafb9d0c6897378ee1a930f3f0c47453570e719a1eeb758aaae0c2cefb5ae5beda2fc0ecc2ef62bb59862cc8b1257bdd6ba230bb6d + '20240807.0': sha512:9143044b1ba9cfd2a38b72e605feedef60dd202d8723ba102e81b81235f1c9e736711189a2d3c166c96a79c97b154e33c9e449b4451ea5b92c5191564d565805 + '20240729.0': sha512:774ede18676e47070a898c1a6c582f8cb9e10355abe85168689739b796a0cb513f4333f19e0037c3969215030f67fbd8d4fe2fb3f560bc854d225592278fd4e5 + '20240722.0': sha512:abbdb166e1913ffe66b70ac75ccf31983fd6fd95ebfc76f3e76ecd6ce32763e8cc9d3abdbe80481a4161dac79e91d8ec767e5304f8977fa98ea54882dcb3698a + '20240305.0': sha256:466c51e4f4bf592da0edf8c70c70ba74f026bb48f980bb28ffb582a93c88c049 + '20240212.0': sha256:4b122fd5684c068d5d73189a30a8130cc5280aefadda0b8532321446c9c79c90 + '20240206.0': sha256:34ded13729aeea0bee6c6d4cbc57ac19a9f4a532631b307ae975cbeb2a09a4ff + '20240129.0': sha256:41c033549c24c13c776db42d212a416a2df20a6cff57cc26f70df8cdff738441 + '20240122.0': sha256:e5f3dbcd7f1b1fb9f46e1432656a8b07dda63a5c65fdbe639062761439df23c0 + '20240115.0': sha256:eae0a657656c4153db44dd51ca285b423b44c4eaad872ea56c18b6a430cdfda5 + '20240109.0': sha256:40eb0a4f5f0013afb221e228fd6e71887127c4b09c7f2eb36705a0cd5c746d57 + '20231218.0': sha256:5f66938de981221359a64f05a5c770b228090db3a2697d91ad622c18dd19f4b2 + amd64: + '20250512.0': sha512:eb7acb5bbd24dd208643b0e91b2195fabd1ca3887612ad33bc34d62a86e4944f3ad80e7592ee5a49cbd6a12aeaa466127a7a220722c2ea64f37df96bebba4ac2 + '20250505.0': sha512:11a1b003a73b2ae8924b03adc557966d815b79d756c9e40adc505c11ffe6f8e30153e5d133566bced39797fbd41651680fc17c0d7686d2ab3cf63b466e68dcc1 + '20250429.0': sha512:42b16d541d589d96075c29e4bf7005bc429c28f411c928412fcd18f093b98f3a7969d799d567730e08f379ce9c2ba7c02bb1e8d10b7fa72179349ac2f40c8d7f + '20250421.0': sha512:eda25a84342130d3fe7f23ec3abad56de0fb08ac36c430b423c2d51cc21a75e902a4671ffac9481bf04f8985ded12110e65aa8a2032bda2699083d1b9b07a672 + '20250414.0': sha512:93fba15f7bd00dec79fbf132d586497f7981cb4bc3ef6cd77e150367cb45f5f2b8aedb00952ff652ec7438d742b773a19ee2b6eae1bf98facd192a5c233d38a3 + '20250407.0': sha512:09acdc895cea6706ba528939da2e6ddab148dfee56addb0d52d7af74378454f4e05cfd47cbb29ad0569139c49cf298be9d4b94a3c2d28b75c05f713e425746e8 + '20250331.0': sha512:94ea230558552362fc4018b5f2e9f3c8af25963a790edc2ba3a454d901fcadaac3c198a0a951fd84c2d7a9c19f2e399f5fc5c22b50d4cb1b76a68a7e80b8c4ae + '20250326.0': sha512:186c188f722ccb249429083bec31b9879b5f52c42b612e0819dfa84d7765bdc79f8305b6e4af9f9344a3cfaacfb1f650fd1be716d93e8b6c596167d6eed1f4df + '20250319.0': sha512:f96512d761656bc3101e46ed5d8f06a5d53ca000c0482af3a0286b6743bac698beb98460b052e393e853c7321562942ff602fa9e7eec5c0979b2621df51a72fc + '20250304.0': sha512:124be185c421f4620417f21e3a9c50569b6310aeb296dc242fa98ceb403f2990aac77d507690fcdd7d200a861f7c95ee44cfbaa6c59155b23ff66a9dbf25994f + '20250224.0': sha512:cd1d0dec2cc8789d62e7fcc3823f2b72907b8c264e785a42e46e0e9cb2b2bf54f558c490a7bdd18d79906c967c4433212bb028d99d4953780a218f6f26f40389 + '20250217.0': sha512:cd1d0dec2cc8789d62e7fcc3823f2b72907b8c264e785a42e46e0e9cb2b2bf54f558c490a7bdd18d79906c967c4433212bb028d99d4953780a218f6f26f40389 + '20250210.0': sha512:ec42c28f9f6d447bfb04206034a596338213ff5239a9875dd8af8bee31e9135800fb76007d58ae94a52cf7a3c3a3758d2e5728c40ff6bae1314a290bc02a1faf + '20250203.0': sha512:de0ecb509a9c0f2e66912868e1f1fe85502a153cfddf460ff3709506cdd459b375f912a87060742a5cc97f8e830d7893175c88c2a7aba0cf35c9af8236a94abe + '20250127.0': sha512:97bb9d5b635a94ebcd9a2cb1fe454ed5bc86eccee59fa30fe66c0392069835fc8abf87528538099fcad3aac9c36a5300a3b592564f6512b3fdaf10d2fa648345 + '20250120.0': sha512:dbab18d58cb5b2584c37988c66a91b063eb5de172c19eb70e19d33faece8c8ed76772d0b78e221353ee1cef43a132e42e175632aeb1c8d8c4feab75d2f888ec8 + '20250113.0': sha512:aacbef03f4bd875f0b9b95d1250952fb7f895250bc196d624a954011dfe44cc9bb7b1910451f52bf61992a93c86cc092a7cfab34de6eacf9bef194137e4103f5 + '20250106.0': sha512:017a687fe2a23f7d9c457bab389a47c442a477d5da6e607c809601cf928ab3fc4e2b538c449b7038c88b28b6f36d146c573d74a7fb6b0a9dafe0cea955a9a965 + '20241217.0': sha512:749836aa25d933189b2579104e540d65093709f70bab8b7c2905d803e9172500dfdbb286d44b77f6e0078592fd6a34d718fa73bc5441da2581375237e7dbb596 + '20241210.0': sha512:feadd2fd7d9a33bdeb32716a20a827560e61b5abca701b89d036176ca0792214b544d0053bf8b771e77fe071364271b4bc6754dba0e223b3da1e73ad72fbc120 + '20241202.0': sha512:75468d59e64963f9613dd65d89e0c2ff396e01e4ba5e4cd62f86baca07c42d5eedba69f720aad107d030d7498a31510dd007d4dd459f46bba9cbec6d38a95a34 + '20241118.0': sha512:07d86582d2b14616a976b09f36e2d65cb75559ec4c18749637e78f7837bf34dbaed0e3c1cd9e188d7663d436802e60db29eff4b486e2180af1faeadd7fcc3799 + '20241104.0': sha512:955254fba6c8199d6ee20aac2b7c0fde3aa97a752a827a7ef26d34f2e3ea5cdf27cb78648413dbc03e4278a5828c7a43240c6a5b2656029c62778fbee9e7c22c + '20241028.0': sha512:bc00332d8a36c635792cd710cce436527e8332200e6d3926d4c13b80c8bf17261aff3e243bfc6a225cc84abb85db8e93d491abe4dc5b12a63fadd4206f33c7df + '20241021.0': sha512:0e7417f82e37aa4ab69edd69cd4215a5bb50816b52bb1aceee02b284ae466199edee67347213a35d0f8a140a22a4bf6b5550c7512a8ff8f8fb36827d8dfbe005 + '20241007.0': sha512:b7cb0ab08ad91689e2b2c8a1afe8b457d7d7af3692d002c24c23e9ddbfa1fcfc62c1a81386c4bf15ae58b0c514447104b1c7b83a57133de62b1c10e3f9c8e73c + '20240930.0': sha512:afe883d0fc3879c421821e41f52999ad0876b8765ddadd55162d255ccd4a5e3968b023e4fd97622e619dc19d07167e935f76240abeb845a56ccaa3f7ac39e886 + '20240923.0': sha512:5416a42e6bd5f88d618a62613dc473f5a1680915794ed07892f6e5ef9e88517bfbe3cf1001364a21a6a3238c10df5c2e0cf3317f96348e733641d045ccfe0930 + '20240916.0': sha512:59db8a4648abae2b55cab3e3653eb7a3bca187b72d241903b639209e8f21e96f3a9132b4d7ae5d048b2fa488fb331bdb6cb185c385eeedbebc674e0946e44330 + '20240826.0': sha512:6e8ca926873950d99b0cfb5e6a7b91d8dc582e75eec463fcf72113d483c47e91a71ca49b9ae32f4d56554d8b580a28f90bb2b23202b0ee71b96f94531dc6eff9 + '20240820.0': sha512:bbbf42b4309c362540fe884e66f9f9888831ee50a9c02d25f07a7758d07e269dd475108f1a4babe2e7b36ac751c8d9462be772fc6ffd0782a27b0b2c2991e5ac + '20240807.0': sha512:48a0a53d914fb2d67ad581c6983a9309fc2dcfbb9e012ca3ef09d16b0c1e72b97a18d4997254336342fc000ae875b89f46173fab5ab65b56a4eec9b316bfc787 + '20240729.0': sha512:ea816bf6e748a44cd396007acb3c7b1617dbaffce7d0288dbb4fce9bae68c3b0d2437b881a84e131106c7413b2b94345420bbca2e7487f8b87b535683567bb94 + '20240722.0': sha512:d95334cd2eded8f417d4b79c24b688abf3628b853400fc8b10f0a3f5faabf572132d8dbd7b0be41f6a0c45cb34d514804b50c31857cd1dff3badfd3aa1bd5f4a + '20240305.0': sha256:11a1b482e0ed6c72ea6ca72692e1cb2d0794214d142be5389e30517a96b157dc + '20240212.0': sha256:48333e9b6158f8d4192a35e1d1f74319b6a083d6cbc3779c847548de6a5faf5f + '20240206.0': sha256:9c88e82b71dc07f689c74f61143ea00fa8621a6d5c31c5fadb9714ad3be8465a + '20240129.0': sha256:840b4b9d47bd04f3dfed6cf8fbee7c2c4a697e17461c22afb873d67499d4d9b9 + '20240122.0': sha256:cd7d9e4bb4cb0ac8242d15fc03580880f53eb36ebd9fb8d686e2811e86ad698e + '20240115.0': sha256:b95d05f667f1040cb07f262f27396d1deb23573ce4c4a31ea3568e6ca3b70c24 + '20240109.0': sha256:d677683326cfd42c7913636651f74ffd1a6866066877903d8a58c644422c2e18 + '20231218.0': sha256:a0578a357feb9320298730bf5ba683880ba35c476dc74dc82c79f0b5acc42656 +nerdctl_archive_checksums: + arm: + 2.0.5: sha256:128bb220999c69cad054cf6394cd70d0665891257db4a7dcbedc5ced409eccb6 + 2.0.4: sha256:89e540cb1ac0ed37ec50afc578970a0c9b6a7f1c1b684368da9a726259a3d359 + 2.0.3: sha256:d95f238738623ae1f4fb01b6a7f287436ba85493700a9de263b3efbff57424d4 + 2.0.2: sha256:910619da11b90d71758e6843543ab2106c20b5149f353289bd6d553151b540ca + 2.0.1: sha256:8f42611dc1554b29dfe990f058ed12920be9cdd78798dcfc6b3845e613eb1252 + 2.0.0: sha256:c68d19a66b6163e67290397ff24660b63c8e6ba6ae3ce4deff33b5a9f7df51d3 + 1.7.7: sha256:26582565426152dc426fd47d8090547128e415314f36710bc58ab475160ab0a4 + 1.7.6: sha256:4c48463659b09636aa23b50825f85cdc38901b6c42e321f69a589d89f6e1d0d5 + 1.7.5: sha256:2d258a7d67e9fa808424ad42f9299a0feb318cafd2758f0287748acedeee4c0d + 1.7.4: sha256:91d3a8bcc2247dd80f8f5769419e6f344dea412937de4c318f65d8e9bf01355b + 1.7.3: sha256:44369f34a98e5955eb02e41779b1a470332194e4c2bef136fe471943eaf8057a + 1.7.2: sha256:d952c1cbe3d25478bbed5f4ee7af4bb52fa4ed47e43802dc5eb2888a4c8da704 + 1.7.1: sha256:799d35de7a182da35d850308c7f1787cd7321404348ff2d5ba64ad43b06b395a + 1.7.0: sha256:8b9e7cccbcc0a472685d1bc285f591f41005f8699e7265ea5438a3e06aefdcfd + arm64: + 2.0.5: sha256:ecf57d202fe6fb1fadb68f25f3d1702a424490f8ca0817a902689f1e1fae9e4d + 2.0.4: sha256:1f394e3aabc2b202ad17a5ece0495ca554ae3ca346a5dd0aa8344a891734763d + 2.0.3: sha256:f2c3f12c99e112cd82ba19ca9b875045c44b2f5a19cecc295ed8d61d415e8851 + 2.0.2: sha256:c50ba98be0ef05684948f7873078558504a7cc46ff92cffc764c1625b1cd0d40 + 2.0.1: sha256:cbca59744f6e9dea962e1d3a754294b5e64b53b82f4f7f7d603a591f38545fd5 + 2.0.0: sha256:568b0383996cb51e1a5f97abb3973ebac2af1a26268fc7d9ae0d34165ba033e1 + 1.7.7: sha256:230ad8f4f88100774d123213a427d3d43071e0dcf9f70efbea50ab9efff1cd4c + 1.7.6: sha256:4fa0a6e936c7a9cb9bb81e784fddaa593cb00afb48b08842e3f0503748c21348 + 1.7.5: sha256:a53d87fc7d1f4ffeec55e5e08d2397b02ada0d334874c3cece306ad36f828a6c + 1.7.4: sha256:d8df47708ca57b9cd7f498055126ba7dcfc811d9ba43aae1830c93a09e70e22d + 1.7.3: sha256:e4f16b78d884768f6997558130146ba9bd7846828b19fa2ca8e8eda988953fd7 + 1.7.2: sha256:de68d5380d65604cd26c164988547cf46b698f7819a5d51d98e3a0f031f5594d + 1.7.1: sha256:46affa0564bb74f595a817e7d5060140099d9cfd9e00e1272b4dbe8b0b85c655 + 1.7.0: sha256:1255eea5bc2dbac9339d0a9acfb0651dda117504d52cd52b38cf3c2251db4f39 + amd64: + 2.0.5: sha256:a029af80fd4b3de096d1a18779e7ff8369fbd1285944ebc50bdd22ad41438b5d + 2.0.4: sha256:2f9d22179868db4f0a1daf2fd65f58a24f8a78efd2d9b17659f56bcdce85efd0 + 2.0.3: sha256:95ff850688a73eace7453f19e74bf4cc8a1f3e458eeb97ef7a6b74de9825df16 + 2.0.2: sha256:1ba015dba039cf6ec2434e88d97707f0b715790e6b7f2e7b6ff7be9200f47bc1 + 2.0.1: sha256:96e5e3ed79f189a986cd33a40b0c817d7b6c7d9238f51a0737213f409e5d82af + 2.0.0: sha256:b3920c4a04dc7972d9e2977147c1ef5c415551802b3c4b0b613ba9d0c46cfbbf + 1.7.7: sha256:298bb95aee485b24d566115ef7e4e90951dd232447b05de5646a652a23db70a9 + 1.7.6: sha256:0326d6a42dbec5c104ed9d7aa8cbc62727433dbe000cf21cc29d06b22507e0f0 + 1.7.5: sha256:775f8bddd5e93acc4162c568dd6b84d5925549180991b83cfd4b7e33d4844921 + 1.7.4: sha256:71aee9d987b7fad0ff2ade50b038ad7e2356324edc02c54045960a3521b3e6a7 + 1.7.3: sha256:ee93ffe6f90e50bde153a9a0dd779594e0bc13a26949053965958b91b6dffdd0 + 1.7.2: sha256:aed7d33d645bfb97c8df978d952a1e1f7e02b0b3ed2c0089ee4285af7f8f971b + 1.7.1: sha256:5fc0a6e8c3a71cbba95fbdb6833fb8a7cd8e78f53de10988362d4029c14b905a + 1.7.0: sha256:844c47b175a3d6bc8eaad0c51f23624a5ef10c09e55607803ec2bc846fb04df9 + ppc64le: + 2.0.5: sha256:01bec466e0184945d8138ef0bc7e6689e61c4c8f56bf0968825c7f5a956c076d + 2.0.4: sha256:93c5bd5f32a3b821fd462a96c6943b06663ff03e8fb16327957fe99576855116 + 2.0.3: sha256:8d6283b1fe871e319a2f5cf96fe97aba649eeaac0a2a22c81b9b4d3c613c210a + 2.0.2: sha256:1baed7f4312404da966155856aa1e4b4f48bae73d64fd2cf6c41ef9326a07b10 + 2.0.1: sha256:78a3846cacc570e8ee4a1d60928a55954fb4fd1b3b731c0c975a808134166fab + 2.0.0: sha256:879efec2963c9854aa1491d80d341570c44dc12b9728084ce64a986ac4fa9bfd + 1.7.7: sha256:8236524c4cc6c91007c794160065716516a4f7b63270dc00b796df11776b4f19 + 1.7.6: sha256:89906f9bcdf8d5bd866646c43e14c0ae15a83ba3ebed44b06c3629a11517e242 + 1.7.5: sha256:8e0891f608144d8d751070edea5cd98d2a76a053ad7fa6b9d4aae94a700aaea2 + 1.7.4: sha256:97c99ab6030ffac1fb780fe012de06a36512b17b13de5c99445468b5a5fe5a62 + 1.7.3: sha256:e63ae0a8f5ccd12877ff944b609d0a4c55c97ba79808ab16c7dc7e99fd8f3dd6 + 1.7.2: sha256:e5c01702d3cec0763d28bd3cf6ea9c3efc58662a93cb4e15669a839782af10d7 + 1.7.1: sha256:09fd0cbef25c98e08c5cc2d1e39da279cbf66c430fdf6c8738e56ce8f949dad9 + 1.7.0: sha256:e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd +containerd_archive_checksums: + arm64: + 2.0.5: sha256:36eaf77dc65df4b60d6e06204631a4105b4e942dd2704d618758a2aa0eecc264 + 2.0.4: sha256:0fde98b24bb55363a54150732e0ac99a43bccf2a9711371bd5470f32790316f2 + 2.0.3: sha256:3701008e72e983259afaa594cca5d8126e78e38cf0a586a1f6971cb3f61c4b6b + 2.0.2: sha256:14a2a9f7f75f73e5bcfb8b183d0b84830c54b98ef8c5f6ed70e51f1a230c673e + 2.0.1: sha256:b07120ae227b52edfdb54131d44b13b987b39e8c1f740b0c969b7701e0fad4fa + 2.0.0: sha256:2a00b1553f38aa9e716d61316b661961c2fbfbb7aad7bd73b377be5725ecc0f1 + 1.7.27: sha256:3f03ea60c7dacddf890be3ab18f7ef859d9d104b19627f52038d7984361912bc + 1.7.26: sha256:adea067914e678ac37d5091ead66f1e36e5cced4d395bbd2be60772495e09eff + 1.7.25: sha256:e9201d478e4c931496344b779eb6cb40ce5084ec08c8fff159a02cabb0c6b9bf + 1.7.24: sha256:420406d2b34ebb422ab3755fbeede59bf3bfcfccf5cfa584b558c93769d99064 + 1.7.23: sha256:6a66b5e63a5e88ff7eeb478ccaca9083d44e51e1d7261ae183fe5951a6226ccd + 1.7.22: sha256:48d0a8461ae829b12b07c3663b14b70287d0607a0792719c51b4e4dd700b02ce + 1.7.21: sha256:7b6b67d998eb86856d23df5d57269c054539072bbb27677975cf78269b2c5c10 + 1.7.20: sha256:cf80cd305f7d1c23aaf0c57bc1c1e37089cad9130d533db6fe968cdebd16c759 + 1.7.19: sha256:1839e6f7cd7c62d9df3ef3deac3f404cdd5cd47bbdf8acfeb0b0f3776eb20002 + 1.7.18: sha256:e80ce87b469af03b3bdcf68b95f0f4a303787ae247581bcd42f04acf1ad4c24d + 1.7.17: sha256:8d9749985796a208e860afe331ec77cb485566104e5cc7c0b5e9e82ec7681969 + 1.7.16: sha256:2d4373de40a6f58cd0f29377c0257b35697a987248e6268520586996771d7a75 + 1.7.15: sha256:5cc8bd8f3d9803ef0ef701596e89d62ad6850a2544e722842f4533642df36d87 + 1.7.14: sha256:44df66d0a0332465e7d15e90b974cd4f08d059dfa26652218ed9485390f47f9e + 1.7.13: sha256:118759e398f35337109592b4d237538872dc12a207d38832b9d04515d0acbc4d + 1.7.12: sha256:8a1b35a521d071a8828f63fe007a51e5b7ac863a1195f5dee32543b1a9d5f2b6 + 1.7.11: sha256:5eae27cce38a14be5390d4035127aa11416bc5ae592a9ff25b11870872ce1159 + 1.7.10: sha256:0667b12a04a896a61cf508a4a77190c280f4a1fa35f38c8a4ba63f605b5ec375 + 1.7.9: sha256:09ca326dee14e00c439137071747c15cc280480e2c26c1e82698c992dd1889c6 + 1.7.8: sha256:3fc551e8f51150804d80cc1958a271bd2252b6334f0355244d0faa5da7fa55d1 + 1.7.7: sha256:0a104f487193665d2681fcb5ed83f2baa5f97849fe2661188da835c9d4eaf9e3 + 1.7.6: sha256:d844a1c8b993e7e9647f73b9814567004dce1287c0529ce55c50519490eafcce + 1.7.5: sha256:98fc6990820d52d45b56ea2cda808157d4e61bb30ded96887634644c03025fa9 + 1.7.4: sha256:ea5a04379bd4252fc1e0b7b37f69cd516350c5269054483535d6eab7a0c79d2e + 1.7.3: sha256:85d2eaedabff57ac1d7cd3884bf232155c4c46491f6b071982e4f7b684b74445 + 1.7.2: sha256:d75a4ca53d9addd0b2c50172d168b12957e18b2d8b802db2658f2767f15889a6 + 1.7.1: sha256:1f828dc063e3c24b0840b284c5635b5a11b1197d564c97f9e873b220bab2b41b + 1.7.0: sha256:e7e5be2d9c92e076f1e2e15c9f0a6e0609ddb75f7616999b843cba92d01e4da2 + 1.6.38: sha256:8a685abe7e5352baab1511933431195964e893e19b4a229af48c7a32ee50ab58 + 1.6.37: sha256:c3da773c40a2e509c13a55fbd25a165c5dfaed7c9b67a71bb4033c3d8d2d0b6a + 1.6.36: sha256:48aaf746ad4adc6e5c3b077875ddbd15a8f5b660a5f7dcb533f0205aeeff3785 + 1.6.35: sha256:0e0066aeffbd4360bfcf16bd08b6a9e40da7f437aa7b292991ce8d08083bee40 + 1.6.34: sha256:9e898686ff003cec2d80c30cf5ad342c1ac88373568dae792f93cd088e66d038 + 1.6.33: sha256:432cf17fbc01ba4fc59b949210baa96865185b8eb3b3292eb7a00e2f6bde9fe9 + 1.6.32: sha256:a9cb16bafbf1eb8cea11b4803d76f78cf7bef311b951dd1ae49c238bb41ec649 + 1.6.31: sha256:91a74cc602c7724668537f754006692114af70cfb6ef840b288f922fa68f7ed7 + 1.6.30: sha256:0bbf1eed508d6ebc240b900648c76f12a07c0c6125aa8c22d46c9ce24252f9e3 + 1.6.28: sha256:96a231f875ddf9cc7682b881d408ae993f2bd5d0a40402a74ec4fda672047427 + 1.6.27: sha256:433b0e8113adfd726374e04fc2f61dafad65c53db5665569f2715a7a916a1813 + 1.6.26: sha256:177bed65b6425255bacbe48d99ea7aa5209d381576962c0962dc8615ef16c5c5 + 1.6.25: sha256:4948677cfc5f98a1d5d46cec90d6d6f84f6b27cd6d28fd87f7f5936d61580ceb + 1.6.24: sha256:1d741e9e2d907f02a8b2a46034a28ff9aacdba88c485cef2f4bad18be9ea23ba + 1.6.23: sha256:ea7afb82dc5789307e684ef9b4a55ce1ee9a05dc02c2118df640b01207208c45 + 1.6.22: sha256:7882d6e7f4e97dcba041c37592c4cb9e7a5b4d972380c74d959e388b12d57d01 + 1.6.21: sha256:d713d8fbec491705ffe8c33ecc9051a904f6eedc92574928e1d33616f291c583 + 1.6.20: sha256:c3e6a054b18b20fce06c7c3ed53f0989bb4b255c849bede446ebca955f07a9ce + 1.6.19: sha256:25a0dd6cce4e1058824d6dc277fc01dc45da92539ccb39bb6c8a481c24d2476e + 1.6.18: sha256:56b83a0bc955edc5ebaa3bd0f788e654b63395be00fcb1bd03ff4bdfe4b5e1e7 + 1.6.17: sha256:7e110faa738bff2f5f0ffd54c4ec2c17c05fd2af6de4877c839794ca3dadd61c + 1.6.16: sha256:c2bf51fde02ec9cf8b9c18721bc4f53bd1f19fb2bb3251f41ece61af7347e082 + 1.6.15: sha256:d63e4d27c51e33cd10f8b5621c559f09ece8a65fec66d80551b36cac9e61a07d + 1.6.14: sha256:3ccb61218e60cbba0e1bbe1e5e2bf809ac1ead8eafbbff36c3195d3edd0e4809 + amd64: + 2.0.5: sha256:88ab31f3e78e4d2fa12dcb933032122d11d441c83b79a89c6c8076f871e50df8 + 2.0.4: sha256:e1c64c5fd60ecd555e750744eaef150b6f78d7f750da5c08c52825aa6b791737 + 2.0.3: sha256:ac70856f1d8bd3aa9ca5d62db5516b86dfa0f934c1fd1d1c5fa4422dd12ba45e + 2.0.2: sha256:9bd5b6a1bdf505d520d9a329c520258ed0a17faa9fe3db12712ee858ad59aae3 + 2.0.1: sha256:85061a5ce1b306292d5a64f85d5cd3aff93d0982737a1069d370dd6cb7bbfd09 + 2.0.0: sha256:6f8da716941f7e89315cefaa6e5a8f1ff10b323ff46611313c455df7ab1ebee1 + 1.7.27: sha256:5b038fb22ab5dbb1ce57dd3d8f102460cd8619ff2afc78870837b06e8c4e840a + 1.7.26: sha256:fdf1fb17086b62fc861103da4e3fda3d79bc543b42d2acef5d07e76b13d35d19 + 1.7.25: sha256:02990fa281c0a2c4b073c6d2415d264b682bd693aa7d86c5d8eb4b86d684a18c + 1.7.24: sha256:1a94f15139f37633f39e24f08a4071f4533b285df3cbee6478972d26147bcaef + 1.7.23: sha256:8a0de43d9313aef2ebdccc0ffa49461a4a28139a2c0ef104c3c847f6f37c8119 + 1.7.22: sha256:f8b2d935d1f86003f4e0c1af3b9f0d2820bacabe6dc9f562785b74af24c5e468 + 1.7.21: sha256:3d1fcdfd0b141f4dc4916b7aee7f9a7773dc344baffc8954e1ca66b1adc5c120 + 1.7.20: sha256:e09410787b6f392748959177a84e024424f75d7aff33ea1c5b783f2260edce67 + 1.7.19: sha256:97f75e60f0ad19d335b1d23385835df721cad4492740d50576997f2717dc3f94 + 1.7.18: sha256:a24b05b341c155a0ec367d3d0fd1d437c09a0261dffdecc0e44e9abbf2d02aca + 1.7.17: sha256:04cf937349f82d29fe98553ff45a7e9ea2ed6b81fe6514e3679cf263b50409ff + 1.7.16: sha256:4f4f2c3c7d14fd59a404961a3a3341303c2fdeeba0e78808c209f606e828f99c + 1.7.15: sha256:ea27e6454954bd9cb62a70b0a40eb085ae9c96cb8c075a74910102b33586e07d + 1.7.14: sha256:48e0d9747cd51cb90e0b278d100397653d9f2e765effca194427e4796395b240 + 1.7.13: sha256:c2371c009dd8b7738663333d91e5ab50d204f8bcae24201f45d59060d12c3a23 + 1.7.12: sha256:6a24d8b996533fa1b0d7348fe9813a78cd01fa16cff865a961ad0d556f5cd665 + 1.7.11: sha256:d66161d54546fad502fd50a13fcb79efff033fcd895adc9c44762680dcde4e69 + 1.7.10: sha256:eacb0296bff2ae5225a18492dcb32fb28ad4a1fe0a39ea9073367c7e43dc5838 + 1.7.9: sha256:ccd5b434393666f6ebbc90eea959ffd3e61958a1e3e1cc830a678f040142d4b0 + 1.7.8: sha256:5f1d017a5a7359514d6187d6656e88fb2a592d107e6298db7963dbddb9a111d9 + 1.7.7: sha256:371de359d6102c51f6ee2361d08297948d134ce7379e01cb965ceeffa4365fba + 1.7.6: sha256:58408cfa025003e671b0af72183b963363d519543d0d0ba186037e9c57489ffe + 1.7.5: sha256:33609ae2d5838bc5798306a1ac30d7f2c6a8cff785ca6253d2be8a8b3ccbab25 + 1.7.4: sha256:fc070fabfe3539d46ae5db160d18381270928b3f912e2e800947e9fbd43f510c + 1.7.3: sha256:de7f61aacba88ee647a7dcde1ca77672ec44ab9fb3e58ae90c0efc9b2d8f3068 + 1.7.2: sha256:2755c70152ab40856510b4549c2dd530e15f5355eb7bf82868e813c9380e22a7 + 1.7.1: sha256:9504771bcb816d3b27fab37a6cf76928ee5e95a31eb41510a7d10ae726e01e85 + 1.7.0: sha256:b068b05d58025dc9f2fc336674cac0e377a478930f29b48e068f97c783a423f0 + 1.6.38: sha256:84f6098c96ff4afc6add67fe4dffc2bb206c86f4b8ceea2157124e4c328697a0 + 1.6.37: sha256:fd74db561289cede7efcede1dce7da92a7da025b4ca8b2c36fc5559ab1892089 + 1.6.36: sha256:e9a53f5f7549afbe9208578609eddecd238b7166663ab273f2954fab77602b3f + 1.6.35: sha256:50f05b2986a8635827e3f015f10d8d1c342e9a9d6886c7392160b5c27ac77c83 + 1.6.34: sha256:18969d667cd6b9993d168f6d30f9ad978f0aca72cf984c1f522fc5277780885b + 1.6.33: sha256:a0c7daa50386dc3ca19cbeb83d6987d43bdd92c0bb0429d08be7f9be4f9c307a + 1.6.32: sha256:7acab4dda6edb7e8e0a6cfc3abd9f323db05a3d92a8a1842de8f6c9e28af501d + 1.6.31: sha256:52080601f414b7e63a5b8e0cb8c1d641c9e070447ac96da9b1aeb00480744ba5 + 1.6.30: sha256:1f1b65190b626883394e6f2ecbe5141afc6c45fc1ca035ef052e66bb2c479a5f + 1.6.28: sha256:b2f15c722d1cc8b74ed643068e043b92bd031fc23d53488d1e837cf4b2777391 + 1.6.27: sha256:8c0b04a8b39127c084d490cca905d565c94929dd15e168b0f8663076fdcf5539 + 1.6.26: sha256:fa806d3e945a8ad25aa1f8123a98524768ead83af2ed1ab3d922d2dd5fe6b14c + 1.6.25: sha256:878b331b5fa65df3d33c68ee355724de0044c25071486086409b374a9c62d145 + 1.6.24: sha256:a56fac5ba03c3d6f74ceae14abdc9fafabcba900105e9890c0ac895cc00164ad + 1.6.23: sha256:bcf16bb63a295721a2603e9a56602c5d18e5443df04a9f2c1ca5328f41556fcc + 1.6.22: sha256:5671eb4eba97f0ec98223c84401c9aeb21d0ef16ac3ece3eb8fadd46174d7eab + 1.6.21: sha256:04dcc1b99368492caee758583e531392683268197e58156888a3cea2941117b6 + 1.6.20: sha256:bb9a9ccd6517e2a54da748a9f60dc9aa9d79d19d4724663f2386812f083968e2 + 1.6.19: sha256:3262454d9b3581f4d4da0948f77dde1be51cfc42347a1548bc9ab6870b055815 + 1.6.18: sha256:c4e516376a2392520a87abea94baf2045cc3a67e9e0c90c75fb6ed038170561e + 1.6.17: sha256:5f0584d000769d0cf08fc0e25135614ef5bf52971a6069175c78437699f3b8d4 + 1.6.16: sha256:2415b431a900275c14942f87f751e1e13d513c1c2f062322b5ca5a9a2190f22a + 1.6.15: sha256:191bb4f6e4afc237efc5c85b5866b6fdfed731bde12cceaa6017a9c7f8aeda02 + 1.6.14: sha256:7da626d46c4edcae1eefe6d48dc6521db3e594a402715afcddc6ac9e67e1bfcd + ppc64le: + 2.0.5: sha256:09773a42829c0ac9b8dd449753c755b3ba65cb7e8d06485950f99d32fd6c1e0d + 2.0.4: sha256:ca970d9a53ae504bc36197d6daa931338c387c83b6948b9f9bfdd1a75e25dcf6 + 2.0.3: sha256:2f0faa0086ae81d00680367ee9d75aafd3c4ca4535362db83fea62dd19c47079 + 2.0.2: sha256:1b19d31bb8a7f9d26d9b50675e78f397d0b01fa635c33cca456f91c412fa6df1 + 2.0.1: sha256:09a25357343c7336fe519e5fd1a9dd0f22da869e9deda50c2bc61b6e8c9384be + 2.0.0: sha256:2e7f4b15ac85c22c1ced102bbb424124078248f0af3183425ff335a998079809 + 1.7.27: sha256:ccdfa16e4bba3a993d74fac794d22ddadc1013d351cd099ea933827050ef05a0 + 1.7.26: sha256:34a86b1bd598b34e8c05956c5976fb0c0b347937d3cd0837edbcebc7f9e7e53f + 1.7.25: sha256:0934176e32eace1c23dcb9edff0e78f872bf8f7152b5e6f622e9ccf1ddce8722 + 1.7.24: sha256:2ca4d527dac68132a2a6b3971d82ddfd18edc7fa838b7cfcfe6eb11efd017871 + 1.7.23: sha256:00dd8a1145d7392ffe1e2b74da147b896e4387afb5e73ed6e5cd3744add32826 + 1.7.22: sha256:6747b7291ffbfde2c0bf0031978985df92ac74414f09bf190afda0fc9e797146 + 1.7.21: sha256:5ce0c1125e8d9ca04e2b524a2bac8b1eb97876c073023d5e083f7da64fcd8207 + 1.7.20: sha256:dc611df0baa90509dda35e0be993da52f42b067514329fcf538d000b110364e8 + 1.7.19: sha256:f41c2f28ee933a9ca24ff02cca159099fbcf798850e56cf0b7a6047ebe21fa86 + 1.7.18: sha256:d6cfb3bc8fbdead7d435d5f3f6b1913b5896f7f97102c1bbad206f9123c2a5d3 + 1.7.17: sha256:873b76a507d362eec73887f61fa1400f3a892c7dbed1759f5dad2b654095b534 + 1.7.16: sha256:d0add7a55a5d4411cafb276469d2b78bc3ada11cb4b444b9e35f9ef60c00960d + 1.7.15: sha256:b38641d9bd18139495cf9839999039b19941f53d36a6d72efe4577c489dfda0c + 1.7.14: sha256:b84b523909b9dd0c0b2bc40bd2b9af543ec9f1186df69c220ae3749e34623dbb + 1.7.13: sha256:89605ed2365d5eb779477d11947101236eb44e5244f1e58bb162a9e68d242798 + 1.7.12: sha256:80f16891b387d86712026234de7d4d0365a38106dbe5e51b65b1200b24822721 + 1.7.11: sha256:6f91c5dabdccd1fc75aae8687381bb185b9eb4200beb29d0993dea8175f5fa61 + 1.7.10: sha256:15a5191bf7c555956a8565d8786399d51b13f2718d59b1a5b2bd380fc420bf8a + 1.7.9: sha256:174b8af2d878ad8410205b9ba44fa8d2a9683a521abf13f168f67b7f7375d5b3 + 1.7.8: sha256:2b563df9e1bddc96a99a023963c99b5faf3066d3fcbc23ff44ba24229e939444 + 1.7.7: sha256:0335e7447ed84757489337686a709e95ffa379a8780f238725abb10facaeaa7f + 1.7.6: sha256:956fadb01b35c3214f2b6f82abc0dda3e1b754cb223cd24e818334b08cb09fb2 + 1.7.5: sha256:2496e24a95fa74750363a8a7e2ac36acf8d41ee2e4b67a452154ad4c8efbc4bc + 1.7.4: sha256:c3397f67fb5756e6336ff76eeb34dfad7ad66235877a4186d82044c7a4caf482 + 1.7.3: sha256:d1977922e74147782dd5bb488f260ee14d758d29a7651cd97bc2e6c7cc1a3cce + 1.7.2: sha256:cbe7ec913cb603ca218bd8867efdce4bee3b0e0115e467e51c910467daf8184e + 1.7.1: sha256:17d97ef55c6ce7af9778dbafb5e73f577d1b34220043a91cccde49dbcc610342 + 1.7.0: sha256:051e897d3ee5b8c8097f65be447fea2d29226b583ca5d9ed78e9aebcf4e69889 + 1.6.38: sha256:8971075ef3ab09a478b57342438f5864984b0d38ecd7f432e295727e2035fe4e + 1.6.37: sha256:de4d165271e04b2fabf4c4c6ad5be81dc121c1b79818e43b37d1807e1932b981 + 1.6.36: sha256:8978cd8bcd4d5a2640bad26d8ea522a46847b6e4a62da1b07bfa482c8906e5ce + 1.6.35: sha256:99095ab778f6fd532eb01d11771e7f8de8383ef20a00ec536c0cf9c018895115 + 1.6.34: sha256:14a4392ba4e533e313fe6d3ed1a68cfdce038b87ad4693be6e71ff31568e2173 + 1.6.33: sha256:0a77fba37290a40a7853dbd7e5a297288d3657f7e92cd7864bc7187189a0a370 + 1.6.32: sha256:d733e4b66ca2bc8191ae5e8770e4806ebd4094fdc657258045b925930ad9bfc5 + 1.6.31: sha256:4458a2398f27241b6e674ea9ba1f56dc4d9ab9dacc5a07469602776c3e428110 + 1.6.30: sha256:ba3d790f504a845b060e2faae3cc0603afd125ebdddb3bdb513b8d70a4337d87 + 1.6.28: sha256:35411f9d1bafc9cae91c2e30d46a59d01bffc7e18ac7f0942dca9d1d5907ab38 + 1.6.27: sha256:8106915bc62c51383baa77925748505e79229fded7efcd7e74cb352ad10d0ce9 + 1.6.26: sha256:75fb01a4bd3bcd16263c2f833b8e7081356e2e390dd7eb0710232cb04dac5a01 + 1.6.25: sha256:3ddcc1739ffeb3e1df786d45518a01d93a5cef243eb6dee61cbdd4cd110bc723 + 1.6.24: sha256:abff9e7ec4cc21d19150d2bc55fc89cf53dc03c002cdaf5016ee82aedead9b03 + 1.6.23: sha256:1099fce4a4dfc78712cc1c19be6d9f80e9321f513834dba0b2418bd5c78ad398 + 1.6.22: sha256:0f8647aedd96174704a63a17b1a7cf4c4c5c2fc066606b1a419b2a860b754bfb + 1.6.21: sha256:196d91799070a5ff2f5f3b6efe8516c5377f299d38012b6c0cf4ae77fc8c22c5 + 1.6.20: sha256:f3ee666fdd31031f07cbb7bad24f0181fad1094ba36273dc61f8fa5a570b5311 + 1.6.19: sha256:18cf11b6dfc980aca8792a2cd3ea7afed6379c2988ca6fe9e53a19a0bece5a2d + 1.6.18: sha256:b7083473061a61200d04f500ad4a96813d1b09f71b2d427019076836c2a49836 + 1.6.17: sha256:2f689ff36ba41c3c86ce926f55b0101118a40dd7b741946386062fddaa287db0 + 1.6.16: sha256:9cfd5dade6a1c2671f5c76496395afe0aa0ce902c13672b306d8d09fdbb99492 + 1.6.15: sha256:502f3e4c8ea2018aaa285fe4f704bfd560fdf93193bb829dd9302d013bc38370 + 1.6.14: sha256:73025da0666079fc3bbd48cf185da320955d323c7dc42d8a4ade0e7926d62bb0 +skopeo_binary_checksums: + arm64: + 1.16.1: sha256:3272f15f469af843d325134ff8a77a069d647c5f247766715c098b8f0622b627 + 1.16.0: sha256:331b09b3b6e6550c178ea1c2fb2bdc5bdbd90c6f6e8d86a974f1117d6ab2fabe + 1.15.2: sha256:f81487af3104e37537ff21f1b2527b294f5cc4e7988941a1655ded97c027ac1d + 1.15.1: sha256:e20e34f96b5545bacd469b0d85ccce811ffbe2809db36248a3becb4638276959 + 1.15.0: sha256:bde8cc7e764d246281430d5da07ca906ee0838803199e3a6136a58802b2e0207 + 1.14.5: sha256:23e157de988c6020f1300b5d73d84d2fed2823ed61dbc6828de3552e9c77a6db + 1.14.4: sha256:d825f93b28cf7502569fe75c46aa78187bb63b6bc06036621de7b63290b51058 + 1.14.3: sha256:e93a82b88e9bff46cbe4e68f96e265d934026a845b76ce51672c7cce26fba164 + 1.14.2: sha256:364c46085de31edf4b312f13587442f4eade1f181bc5a9ea2ab2ffab5b575916 + 1.14.1: sha256:fd4fc0adae14f27788fd52cf0d23be2cfd1963e184c4af689de30185455e29a6 + 1.13.3: sha256:1f7726b020ff9bc931ce16caa13c29999738a231f1414028282cd8f8661eb747 + 1.13.2: sha256:520cc31c15796405b82d01c78629d5b581eced3512ca0b6b184ed82f5e18dc86 + 1.13.1: sha256:3b7db2b827fea432aa8a861b5caa250271c05da70bd240aa4045f692eba52e24 + 1.13.0: sha256:d23e43323c0a441d1825f9da483b07c7f265f2bd0a4728f7daac4239460600a3 + amd64: + 1.16.1: sha256:8813fb7fcd7a723196ac287683dd929d280f6fe7f0782eace452fe1e3ff2b7eb + 1.16.0: sha256:7bc31ed810d1366304d2e975c2910cea5e22cbd68f8316f14cacf44f6c0bd1d2 + 1.15.2: sha256:6b84d1158f29610f692f24c82459a865c2a21911647cc0cdf44027e7a59f73ba + 1.15.1: sha256:d45a93dab851f072fe5d3f0419f5c8bb3ee48069b588c211cccebd023fd5ae3a + 1.15.0: sha256:3cdbcde0163abb4c942f62d0302479d5aa4d31c5970d712841cf5d5f76edc594 + 1.14.5: sha256:180c2d7e8bc00685ba291572db6ddd90acadf03af7595521da17ae1f2c28f4b1 + 1.14.4: sha256:4c6f8f7c6e5f01675adff8c5bbb542d8d02b9bbdecf0d2abac1e99b8a34a9768 + 1.14.3: sha256:2db7e036e99ad3b808aaffbafc5267391bd3ba2f45ff03dd0090686eb3eb0f1e + 1.14.2: sha256:51218f93a2b079e36a36f7fbe2d2d86778be0a6947653031b4f9e254e2469224 + 1.14.1: sha256:6b7776bcdf0c92af5d3f3c91a959d091011b42d839025b90f12b7201a083f308 + 1.13.3: sha256:65707992885b1a4a446af6342874749478a1af7e17ab3f4df8fb89509e8b1966 + 1.13.2: sha256:2f00be6ee1c4cbfa7f2452be90a1a2ce88fd92a6d0f6a2e9d901bd2087bd9092 + 1.13.1: sha256:8c15c56a6caffeb863c17d73a6361218c04c7763e020fffc8d5d6745cacfa901 + 1.13.0: sha256:8cb477ee25010497fc9df53a6205dbd9fe264dd8a5ea4e934b9ec24d5bdc126c + ppc64le: + 1.16.1: sha256:248f8f601e4c40dd6d603b66ac26246f96d18451cc3642718c59afb6c2403cf7 + 1.16.0: sha256:24f1266d6146c27143b5002387c5b68086f1355de7db5c9bfe820928e3b8e298 + 1.15.2: sha256:5b123d38c34024e8b62b3bc94abfeea3007291743260bf7f62b2a1d935f1c3f9 + 1.15.1: sha256:39a4a6d77daca09a93a0b490285f48cd9040da1ba9c05b1f9709483e4f65c318 + 1.15.0: sha256:fb7f390f52f4b81f85d9bdce8715af5e27ee3969eff236b5f3c0f3a0b5a182e1 + 1.14.5: sha256:4ed476c46fabb3b320aac9b88ddc1b7a2665cb151a93482db7cb98e5768a768f + 1.14.4: sha256:f1b37ad1b83bd43bada6e49518165cf41d727d0662351dc5fcc9a46f0c3b4482 + 1.14.3: sha256:9028b7c4aafe235f1ba4efd57435b97ace341e544d3a6807440ac3b0f32d7d73 +yq_checksums: + arm: + 4.42.1: sha256:4e3fe0c37793d28e96d465d9958fbf679d8c616e1857d0faf7980ad087f32aee + 4.41.1: sha256:ccd50344652c02574ca7dd123c7d66a06b391838e8ca6088b688e6edf2e25d0c + 4.40.7: sha256:fb922bb1e3974fbd15957feafb5e9bbabe43f4192999cf9b3e0e470815f2e0da + 4.40.5: sha256:c587b2411e43d3fbcdd24c233fb558a362b5111a8446b23f9ce9a4a5665a7041 + 4.40.4: sha256:2ff3f17483f2172a20130b16328114bfe6abd7d3068d66d8194a5093079e8529 + 4.40.3: sha256:6a97856e8b4ef992ce08dcfdf97fec517cf612b1a89078406f401673f126c21c + arm64: + 4.42.1: sha256:16a57531a594b66c3e0981cd93f9e9cd4b684a347b86eaf5e3f409074ad67eb8 + 4.41.1: sha256:066aa930d74e39a25447b1900d8cbb3e1c7df72cd75bc203bc6ae5ee577a5b4a + 4.40.7: sha256:a84f2c8f105b70cd348c3bf14048aeb1665c2e7314cbe9aaff15479f268b8412 + 4.40.5: sha256:9431f0fa39a0af03a152d7fe19a86e42e9ff28d503ed4a70598f9261ec944a97 + 4.40.4: sha256:79c61a1ebfedb165ec8c4678777775b52e2c581801f5d4cd80f97300852fe0f0 + 4.40.3: sha256:44a5cca10d33019b8a46212882197be4f961dfe7deddde0af497065aa980a6a4 + amd64: + 4.42.1: sha256:1a95960dddd426321354d58d2beac457717f7c49a9ec0806749a5a9e400eb45e + 4.41.1: sha256:ce0d5a61c256a463fd32f67f133e0c2948bc2cf77d44c42ff335a40e6bef34bf + 4.40.7: sha256:4f13ee9303a49f7e8f61e7d9c87402e07cc920ae8dfaaa8c10d7ea1b8f9f48ed + 4.40.5: sha256:0d6aaf1cf44a8d18fbc7ed0ef14f735a8df8d2e314c4cc0f0242d35c0a440c95 + 4.40.4: sha256:f9163412d9aa2aa55e888fdcaf2b4053ada20074be35f701424caa7163100704 + 4.40.3: sha256:6e9a5ed9591dbf1d13aaec4efaaf0ecdaf4945ea393b9ce01f4c3dea22311470 + ppc64le: + 4.42.1: sha256:d0d1cdbd2c4a7e6995433baf879cadaa47f6f12290e1661ea11933ed90baccb6 + 4.41.1: sha256:eed2af79d0ad787878b2d5c7c592e43ac152208d9ed432b42a43663167e276e8 + 4.40.7: sha256:ac0e8d06a7ed9afc108b4e2e9d6900312b01757f61b75fcecb809f15c39b10e7 + 4.40.5: sha256:a1df9d2b872fbb30583526bf4f37f737dc1913b28606dfc1dafeaf56a8862b3d + 4.40.4: sha256:c67379085a44558825a60a8af3b59b400852b168356070829bc0f45c70553f45 + 4.40.3: sha256:2fe818a0b141913a41548e0e727267479d0f755221c73f9e304788c8e9139a45 +gateway_api_standard_crds_checksums: + no_arch: + 1.2.1: sha256:97598bf6ab3b33b9b5c5432bdd24de091e4e9c3aa0575ebb0710a2a19cd64d64 + 1.2.0: sha256:38ed055bb25dc580c0366899c0bed9b9e92dfcd1c180a569133f3946026cf102 + 1.1.0: sha256:c411805475d430a34242623a8e17153a7c40e946497bfd494e558b0d1a8858b3 + 1.0.0: sha256:23e4e1095c72a0587474f7fb3f85c319cdec77a083ab91237ffbdec1f1834d2a +gateway_api_experimental_crds_checksums: + no_arch: + 1.2.1: sha256:d3aa6723a3306770cffb601ee22af3d35da43acfa1ca547fc0d3bce08dad66e7 + 1.2.0: sha256:4369188e63b9ab5a35b5a83032c94d871159dece086b908b6ea18ea321ca06a9 + 1.1.0: sha256:10f322744a005d4e73e2b067e95fecd4cfec619dc7564930b488c296bfa3bec1 + 1.0.0: sha256:6c601dced7872a940d76fa667ae126ba718cb4c6db970d0bab49128ecc1192a3 diff --git a/kubespray/project/roles/kubespray_defaults/vars/main/main.yml b/kubespray/project/roles/kubespray_defaults/vars/main/main.yml new file mode 100644 index 0000000..6737b8e --- /dev/null +++ b/kubespray/project/roles/kubespray_defaults/vars/main/main.yml @@ -0,0 +1,29 @@ +--- +# Kubespray constants + +kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}" + +# The lowest version allowed to upgrade from (same as calico_version in the previous branch) +calico_min_version_required: "3.27.0" + +containerd_min_version_required: "1.3.7" + +# mixed kube_service_addresses/kube_service_addresses_ipv6 for a variety of network stacks(dualstack, ipv6only, ipv4only) +kube_service_subnets: >- + {%- if ipv4_stack and ipv6_stack -%} + {{ kube_service_addresses }},{{ kube_service_addresses_ipv6 }} + {%- elif ipv4_stack -%} + {{ kube_service_addresses }} + {%- else -%} + {{ kube_service_addresses_ipv6 }} + {%- endif -%} + +# mixed kube_pods_subnet/kube_pods_subnet_ipv6 for a variety of network stacks(dualstack, ipv6only, ipv4only) +kube_pods_subnets: >- + {%- if ipv4_stack and ipv6_stack -%} + {{ kube_pods_subnet }},{{ kube_pods_subnet_ipv6 }} + {%- elif ipv4_stack -%} + {{ kube_pods_subnet }} + {%- else -%} + {{ kube_pods_subnet_ipv6 }} + {%- endif -%} diff --git a/kubespray/project/roles/network_facts/meta/main.yml b/kubespray/project/roles/network_facts/meta/main.yml new file mode 100644 index 0000000..5b1432e --- /dev/null +++ b/kubespray/project/roles/network_facts/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: kubespray_defaults diff --git a/kubespray/project/roles/network_facts/tasks/main.yaml b/kubespray/project/roles/network_facts/tasks/main.yaml new file mode 100644 index 0000000..eca6577 --- /dev/null +++ b/kubespray/project/roles/network_facts/tasks/main.yaml @@ -0,0 +1,58 @@ +--- +- name: Set facts variables + tags: + - always + block: + - name: Gather ansible_default_ipv4 + setup: + gather_subset: '!all,network' + filter: "ansible_default_ipv4" + when: ansible_default_ipv4 is not defined + ignore_unreachable: true + # Set 127.0.0.1 as fallback IP if we do not have host facts for host + # ansible_default_ipv4 isn't what you think. + # https://medium.com/opsops/ansible-default-ipv4-is-not-what-you-think-edb8ab154b10 + # TODO: discard this and update all the location relying on it in "looping on hostvars" templates + - name: Set fallback_ip + set_fact: + fallback_ip: "{{ ansible_default_ipv4.address | d('127.0.0.1') }}" + when: fallback_ip is not defined + + - name: Gather ansible_default_ipv6 + setup: + gather_subset: '!all,network' + filter: "ansible_default_ipv6" + when: ansible_default_ipv6 is not defined + ignore_unreachable: true + - name: Set fallback_ip6 + set_fact: + fallback_ip6: "{{ ansible_default_ipv6.address | d('::1') }}" + when: fallback_ip6 is not defined + + - name: Set main access ip(access_ip based on ipv4_stack/ipv6_stack options). + set_fact: + cacheable: true + main_access_ip: >- + {%- if ipv4_stack -%} + {{ access_ip | default(ip | default(fallback_ip)) }} + {%- else -%} + {{ access_ip6 | default(ip6 | default(fallback_ip6)) }} + {%- endif -%} + + - name: Set main ip(ip based on ipv4_stack/ipv6_stack options). + set_fact: + main_ip: "{{ (ip | default(fallback_ip)) if ipv4_stack else (ip6 | default(fallback_ip6)) }}" + + - name: Set main access ips(mixed ips for dualstack). + set_fact: + main_access_ips: ["{{ (main_access_ip + ',' + (access_ip6 | default(ip6 | default(fallback_ip6)))) if (ipv4_stack and ipv6_stack) else main_access_ip }}"] + + - name: Set main ips(mixed ips for dualstack). + set_fact: + main_ips: ["{{ (main_ip + ',' + (ip6 | default(fallback_ip6))) if (ipv4_stack and ipv6_stack) else main_ip }}"] + + - name: Set no_proxy + import_tasks: no_proxy.yml + when: + - http_proxy is defined or https_proxy is defined + - no_proxy is not defined diff --git a/kubespray/project/roles/kubespray-defaults/tasks/no_proxy.yml b/kubespray/project/roles/network_facts/tasks/no_proxy.yml similarity index 72% rename from kubespray/project/roles/kubespray-defaults/tasks/no_proxy.yml rename to kubespray/project/roles/network_facts/tasks/no_proxy.yml index adec886..56b9446 100644 --- a/kubespray/project/roles/kubespray-defaults/tasks/no_proxy.yml +++ b/kubespray/project/roles/network_facts/tasks/no_proxy.yml @@ -8,12 +8,12 @@ {{ loadbalancer_apiserver.address | default('') }}, {%- endif -%} {%- if no_proxy_exclude_workers | default(false) -%} - {% set cluster_or_master = 'kube_control_plane' %} + {% set cluster_or_control_plane = 'kube_control_plane' %} {%- else -%} - {% set cluster_or_master = 'k8s_cluster' %} + {% set cluster_or_control_plane = 'k8s_cluster' %} {%- endif -%} - {%- for item in (groups[cluster_or_master] + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique -%} - {{ hostvars[item]['access_ip'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}, + {%- for item in (groups[cluster_or_control_plane] + groups['etcd'] | default([]) + groups['calico_rr'] | default([])) | unique -%} + {{ hostvars[item]['main_access_ip'] }}, {%- if item != hostvars[item].get('ansible_hostname', '') -%} {{ hostvars[item]['ansible_hostname'] }}, {{ hostvars[item]['ansible_hostname'] }}.{{ dns_domain }}, @@ -23,7 +23,7 @@ {%- if additional_no_proxy is defined -%} {{ additional_no_proxy }}, {%- endif -%} - 127.0.0.1,localhost,{{ kube_service_addresses }},{{ kube_pods_subnet }},svc,svc.{{ dns_domain }} + 127.0.0.1,localhost,{{ kube_service_subnets }},{{ kube_pods_subnets }},svc,svc.{{ dns_domain }} delegate_to: localhost connection: local delegate_facts: true diff --git a/kubespray/project/roles/network_plugin/calico/tasks/check.yml b/kubespray/project/roles/network_plugin/calico/tasks/check.yml index 7f73a08..d512a96 100644 --- a/kubespray/project/roles/network_plugin/calico/tasks/check.yml +++ b/kubespray/project/roles/network_plugin/calico/tasks/check.yml @@ -24,22 +24,11 @@ delegate_to: "{{ groups['kube_control_plane'][0] }}" -- name: Stop if incompatible network plugin and cloudprovider - assert: - that: - - calico_ipip_mode == 'Never' - - calico_vxlan_mode in ['Always', 'CrossSubnet'] - msg: "When using cloud_provider azure and network_plugin calico calico_ipip_mode must be 'Never' and calico_vxlan_mode 'Always' or 'CrossSubnet'" - when: - - cloud_provider is defined and cloud_provider == 'azure' - run_once: true - delegate_to: "{{ groups['kube_control_plane'][0] }}" - - name: Stop if supported Calico versions assert: that: - - "calico_version in calico_crds_archive_checksums.keys()" - msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.keys() }}" + - "calico_version in calico_crds_archive_checksums.no_arch.keys()" + msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.no_arch.keys() }}" run_once: true delegate_to: "{{ groups['kube_control_plane'][0] }}" @@ -76,7 +65,7 @@ - name: Assert that current calico version is enough for upgrade assert: that: - - calico_version_on_server.stdout is version(calico_min_version_required, '>=') + - calico_version_on_server.stdout.removeprefix('v') is version(calico_min_version_required, '>=') msg: > Your version of calico is not fresh enough for upgrade. Minimum version is {{ calico_min_version_required }} supported by the previous kubespray release. @@ -157,12 +146,16 @@ check_mode: false register: calico run_once: true + when: ipv4_stack | bool delegate_to: "{{ groups['kube_control_plane'][0] }}" - name: "Set calico_pool_conf" set_fact: calico_pool_conf: '{{ calico.stdout | from_json }}' - when: calico.rc == 0 and calico.stdout + when: + - ipv4_stack | bool + - calico is defined + - calico.rc == 0 and calico.stdout run_once: true delegate_to: "{{ groups['kube_control_plane'][0] }}" @@ -175,10 +168,45 @@ - not calico_pool_conf.spec.vxlanMode is defined or calico_pool_conf.spec.vxlanMode == calico_vxlan_mode msg: "Your inventory doesn't match the current cluster configuration" when: + - ipv4_stack | bool - calico_pool_conf is defined run_once: true delegate_to: "{{ groups['kube_control_plane'][0] }}" +- name: "Get Calico {{ calico_pool_name }}-ipv6 configuration" + command: "{{ bin_dir }}/calicoctl.sh get ipPool {{ calico_pool_name }}-ipv6 -o json" + failed_when: false + changed_when: false + check_mode: false + register: calico_ipv6 + run_once: true + when: ipv6_stack | bool + delegate_to: "{{ groups['kube_control_plane'][0] }}" + +- name: "Set calico_pool_ipv6_conf" + set_fact: + calico_pool_conf: '{{ calico_ipv6.stdout | from_json }}' + when: + - ipv6_stack | bool + - alico_ipv6 is defined + - calico_ipv6.rc == 0 and calico_ipv6.stdout + run_once: true + delegate_to: "{{ groups['kube_control_plane'][0] }}" + +- name: "Check if ipv6 inventory match current cluster configuration" + assert: + that: + - calico_pool_conf.spec.blockSize | int == calico_pool_blocksize_ipv6 | int + - calico_pool_conf.spec.cidr == (calico_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6)) + - not calico_pool_conf.spec.ipipMode is defined or calico_pool_conf.spec.ipipMode == calico_ipip_mode_ipv6 + - not calico_pool_conf.spec.vxlanMode is defined or calico_pool_conf.spec.vxlanMode == calico_vxlan_mode_ipv6 + msg: "Your ipv6 inventory doesn't match the current cluster configuration" + when: + - ipv6_stack | bool + - calico_pool_ipv6_conf is defined + run_once: true + delegate_to: "{{ groups['kube_control_plane'][0] }}" + - name: "Check kdd calico_datastore if calico_apiserver_enabled" assert: that: calico_datastore == "kdd" @@ -202,7 +230,6 @@ that: - "calico_ipip_mode_ipv6 in ['Never']" msg: "Calico doesn't support ipip tunneling for the IPv6" - when: - - enable_dual_stack_networks + when: ipv6_stack | bool run_once: true delegate_to: "{{ groups['kube_control_plane'][0] }}" diff --git a/kubespray/project/roles/network_plugin/calico/tasks/install.yml b/kubespray/project/roles/network_plugin/calico/tasks/install.yml index 1d3b023..52bd5c4 100644 --- a/kubespray/project/roles/network_plugin/calico/tasks/install.yml +++ b/kubespray/project/roles/network_plugin/calico/tasks/install.yml @@ -84,6 +84,7 @@ changed_when: false when: - inventory_hostname == groups['kube_control_plane'][0] + - ipv4_stack | bool - name: Calico | Ensure that calico_pool_cidr is within kube_pods_subnet when defined assert: @@ -91,8 +92,9 @@ msg: "{{ calico_pool_cidr }} is not within or equal to {{ kube_pods_subnet }}" when: - inventory_hostname == groups['kube_control_plane'][0] - - 'calico_conf.stdout == "0"' + - ipv4_stack | bool - calico_pool_cidr is defined + - 'calico_conf.stdout == "0"' - name: Calico | Check if calico IPv6 network pool has already been configured # noqa risky-shell-pipe - grep will exit 1 if no match found @@ -107,7 +109,7 @@ changed_when: false when: - inventory_hostname == groups['kube_control_plane'][0] - - enable_dual_stack_networks + - ipv6_stack - name: Calico | Ensure that calico_pool_cidr_ipv6 is within kube_pods_subnet_ipv6 when defined assert: @@ -115,29 +117,29 @@ msg: "{{ calico_pool_cidr_ipv6 }} is not within or equal to {{ kube_pods_subnet_ipv6 }}" when: - inventory_hostname == groups['kube_control_plane'][0] + - ipv6_stack | bool - calico_conf_ipv6.stdout is defined and calico_conf_ipv6.stdout == "0" - calico_pool_cidr_ipv6 is defined - - enable_dual_stack_networks - name: Calico | kdd specific configuration when: - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - calico_datastore == "kdd" block: - name: Calico | Check if extra directory is needed stat: - path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ 'kdd' if (calico_version is version('v3.22.3', '<')) else 'crd' }}" + path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ 'kdd' if (calico_version is version('3.22.3', '<')) else 'crd' }}" register: kdd_path - name: Calico | Set kdd path when calico < v3.22.3 set_fact: calico_kdd_path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds{{ '/kdd' if kdd_path.stat.exists is defined and kdd_path.stat.exists }}" when: - - calico_version is version('v3.22.3', '<') - - name: Calico | Set kdd path when calico > v3.22.2 + - calico_version is version('3.22.3', '<') + - name: Calico | Set kdd path when calico > 3.22.2 set_fact: calico_kdd_path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds{{ '/crd' if kdd_path.stat.exists is defined and kdd_path.stat.exists }}" when: - - calico_version is version('v3.22.2', '>') + - calico_version is version('3.22.2', '>') - name: Calico | Create calico manifests for kdd assemble: src: "{{ calico_kdd_path }}" @@ -206,6 +208,7 @@ - name: Calico | Configure Calico IP Pool when: - inventory_hostname == groups['kube_control_plane'][0] + - ipv4_stack | bool block: - name: Calico | Get existing calico network pool command: "{{ bin_dir }}/calicoctl.sh get ippool {{ calico_pool_name }} -o json" @@ -256,7 +259,7 @@ - name: Calico | Configure Calico IPv6 Pool when: - inventory_hostname == groups['kube_control_plane'][0] - - enable_dual_stack_networks | bool + - ipv6_stack | bool block: - name: Calico | Get existing calico ipv6 network pool command: "{{ bin_dir }}/calicoctl.sh get ippool {{ calico_pool_name }}-ipv6 -o json" @@ -321,7 +324,7 @@ nodeToNodeMeshEnabled: "false" when: - peer_with_router | default(false) or peer_with_calico_rr | default(false) - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) run_once: true - name: Calico | Configure Calico BGP @@ -350,7 +353,15 @@ {% if not calico_no_global_as_num | default(false) %}"asNumber": {{ global_as_num }},{% endif %} "nodeToNodeMeshEnabled": {{ nodeToNodeMeshEnabled | default('true') }} , {% if calico_advertise_cluster_ips | default(false) %} - "serviceClusterIPs": [{"cidr": "{{ kube_service_addresses }}" } {{ ',{"cidr":"' + kube_service_addresses_ipv6 + '"}' if enable_dual_stack_networks else '' }}],{% endif %} + "serviceClusterIPs": >- + {%- if ipv4_stack and ipv6_stack-%} + [{"cidr": "{{ kube_service_addresses }}", "cidr": "{{ kube_service_addresses_ipv6 }}"}], + {%- elif ipv6_stack-%} + [{"cidr": "{{ kube_service_addresses_ipv6 }}"}], + {%- else -%} + [{"cidr": "{{ kube_service_addresses }}"}], + {%- endif -%} + {% endif %} {% if calico_advertise_service_loadbalancer_ips | length > 0 %}"serviceLoadBalancerIPs": {{ _service_loadbalancer_ips }},{% endif %} "serviceExternalIPs": {{ _service_external_ips | default([]) }} } @@ -382,7 +393,7 @@ - {name: kubernetes-services-endpoint, file: kubernetes-services-endpoint.yml, type: cm } register: calico_node_manifests when: - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - rbac_enabled or item.type not in rbac_resources - name: Calico | Create calico manifests for typha @@ -394,7 +405,7 @@ - {name: calico, file: calico-typha.yml, type: typha} register: calico_node_typha_manifest when: - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - typha_enabled - name: Calico | get calico apiserver caBundle @@ -421,7 +432,7 @@ - {name: calico, file: calico-apiserver.yml, type: calico-apiserver} register: calico_apiserver_manifest when: - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - calico_apiserver_enabled - name: Start Calico resources @@ -473,7 +484,7 @@ with_items: - {name: calico, file: calico-ipamconfig.yml, type: ipam} when: - - inventory_hostname in groups['kube_control_plane'] + - ('kube_control_plane' in group_names) - calico_datastore == "kdd" - name: Calico | Create ipamconfig resources diff --git a/kubespray/project/roles/network_plugin/calico/tasks/peer_with_calico_rr.yml b/kubespray/project/roles/network_plugin/calico/tasks/peer_with_calico_rr.yml index 9d216bd..53b49c1 100644 --- a/kubespray/project/roles/network_plugin/calico/tasks/peer_with_calico_rr.yml +++ b/kubespray/project/roles/network_plugin/calico/tasks/peer_with_calico_rr.yml @@ -32,7 +32,7 @@ when: - calico_rr_id is defined - calico_group_id is defined - - inventory_hostname in groups['calico_rr'] + - ('calico_rr' in group_names) - name: Calico | Configure peering with route reflectors at global scope command: diff --git a/kubespray/project/roles/network_plugin/calico/tasks/peer_with_router.yml b/kubespray/project/roles/network_plugin/calico/tasks/peer_with_router.yml index 5c25f09..ec4104b 100644 --- a/kubespray/project/roles/network_plugin/calico/tasks/peer_with_router.yml +++ b/kubespray/project/roles/network_plugin/calico/tasks/peer_with_router.yml @@ -28,7 +28,7 @@ cmd: "{{ bin_dir }}/calicoctl.sh get node {{ inventory_hostname }}" register: output_get_node when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - local_as is defined - groups['calico_rr'] | default([]) | length == 0 delegate_to: "{{ groups['kube_control_plane'][0] }}" @@ -50,7 +50,7 @@ until: output.rc == 0 delay: "{{ retry_stagger | random + 3 }}" when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - local_as is defined - groups['calico_rr'] | default([]) | length == 0 - output_get_node.rc == 0 @@ -77,7 +77,7 @@ until: output.rc == 0 delay: "{{ retry_stagger | random + 3 }}" when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) - local_as is defined - groups['calico_rr'] | default([]) | length == 0 - output_get_node.rc != 0 @@ -97,9 +97,12 @@ "asNumber": "{{ item.as }}", "node": "{{ inventory_hostname }}", "peerIP": "{{ item.router_id }}", - {% if calico_version is version('v3.26.0', '>=') and (item.filters | default([]) | length > 0) %} + {% if calico_version is version('3.26.0', '>=') and (item.filters | default([]) | length > 0) %} "filters": {{ item.filters }}, {% endif %} + {% if calico_version is version('3.23.0', '>=') and (item.numallowedlocalasnumbers | default(0) > 0) %} + "numAllowedLocalASNumbers": {{ item.numallowedlocalasnumbers }}, + {% endif %} "sourceAddress": "{{ item.sourceaddress | default('UseNodeIP') }}" }} register: output @@ -110,4 +113,4 @@ - "{{ peers | default([]) | selectattr('scope', 'undefined') | list | union(peers | default([]) | selectattr('scope', 'defined') | selectattr('scope', 'equalto', 'node') | list ) }}" delegate_to: "{{ groups['kube_control_plane'][0] }}" when: - - inventory_hostname in groups['k8s_cluster'] + - ('k8s_cluster' in group_names) diff --git a/kubespray/project/roles/network_plugin/calico/tasks/pre.yml b/kubespray/project/roles/network_plugin/calico/tasks/pre.yml index 969699f..f3f7797 100644 --- a/kubespray/project/roles/network_plugin/calico/tasks/pre.yml +++ b/kubespray/project/roles/network_plugin/calico/tasks/pre.yml @@ -20,17 +20,6 @@ - "'plugins' in calico_cni_config" - "'etcd_endpoints' in calico_cni_config.plugins.0" -- name: Calico | Get kubelet hostname - shell: >- - set -o pipefail && {{ kubectl }} get node -o custom-columns='NAME:.metadata.name,INTERNAL-IP:.status.addresses[?(@.type=="InternalIP")].address' - | egrep "{{ ansible_all_ipv4_addresses | join('$|') }}$" | cut -d" " -f1 - args: - executable: /bin/bash - register: calico_kubelet_name - delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: - - "cloud_provider is defined" - - name: Calico | Gather os specific variables include_vars: "{{ item }}" with_first_found: diff --git a/kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2 b/kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2 index 769c78c..e49c2b2 100644 --- a/kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2 +++ b/kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2 @@ -72,7 +72,7 @@ spec: initialDelaySeconds: 90 periodSeconds: 10 name: calico-apiserver -{% if calico_version is version('v3.28.0', '>=') %} +{% if calico_version is version('3.28.0', '>=') %} readinessProbe: httpGet: path: /readyz @@ -176,6 +176,7 @@ rules: - ipamblocks - blockaffinities - caliconodestatuses + - tiers verbs: - get - list @@ -183,7 +184,7 @@ rules: - create - update - delete -{% if calico_version is version('v3.28.0', '>=') %} +{% if calico_version is version('3.28.0', '>=') %} - apiGroups: - policy resourceNames: diff --git a/kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2 b/kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2 index d949af1..1e87917 100644 --- a/kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2 +++ b/kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2 @@ -53,13 +53,15 @@ data: "type": "host-local", "subnet": "usePodCidr" }, - {% else %} + {% else %} "ipam": { "type": "calico-ipam", - {% if enable_dual_stack_networks %} - "assign_ipv6": "true", - {% endif %} - "assign_ipv4": "true" + {% if ipv4_stack %} + "assign_ipv4": "true"{{ ',' if (ipv6_stack and ipv4_stack) }} + {% endif %} + {% if ipv6_stack %} + "assign_ipv6": "true" + {% endif %} }, {% endif %} {% if calico_allow_ip_forwarding %} diff --git a/kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2 b/kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2 index 7ddec16..96f59df 100644 --- a/kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2 +++ b/kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2 @@ -86,6 +86,13 @@ rules: verbs: - watch - list + # Watch for changes to Kubernetes AdminNetworkPolicies. + - apiGroups: ["policy.networking.k8s.io"] + resources: + - adminnetworkpolicies + verbs: + - watch + - list # Used by Calico for policy information. - apiGroups: [""] resources: @@ -121,10 +128,17 @@ rules: - hostendpoints - blockaffinities - caliconodestatuses + - tiers verbs: - get - list - watch + # Calico creates some tiers on startup. + - apiGroups: ["crd.projectcalico.org"] + resources: + - tiers + verbs: + - create # Calico must create and update some CRDs on startup. - apiGroups: ["crd.projectcalico.org"] resources: diff --git a/kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2 b/kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2 index ff85a51..d5b509b 100644 --- a/kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2 +++ b/kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2 @@ -1,7 +1,7 @@ --- # This manifest installs the calico/node container, as well # as the Calico CNI plugins and network config on -# each master and worker node in a Kubernetes cluster. +# each control plane and worker node in a Kubernetes cluster. kind: DaemonSet apiVersion: apps/v1 metadata: @@ -13,6 +13,10 @@ spec: selector: matchLabels: k8s-app: calico-node + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 template: metadata: labels: @@ -30,10 +34,16 @@ spec: {{ calico_ds_nodeselector }} priorityClassName: system-node-critical hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet serviceAccountName: calico-node tolerations: - - operator: Exists + # Make sure calico-node gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. terminationGracePeriodSeconds: 0 @@ -90,9 +100,11 @@ spec: # Name of the CNI config file to create. - name: CNI_CONF_NAME value: "10-calico.conflist" - # Install CNI binaries - - name: UPDATE_CNI_BINARIES - value: "true" +{% if calico_mtu is defined %} + # CNI MTU Config variable + - name: CNI_MTU + value: "{{ calico_veth_mtu | default(calico_mtu) }}" +{% endif %} # Prevents the container from sleeping forever. - name: SLEEP value: "false" @@ -117,14 +129,29 @@ spec: name: cni-bin-dir securityContext: privileged: true - # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes - # to communicate with Felix over the Policy Sync API. - - name: flexvol-driver - image: {{ calico_flexvol_image_repo }}:{{ calico_flexvol_image_tag }} + # This init container mounts the necessary filesystems needed by the BPF data plane + # i.e. bpf at /sys/fs/bpf and cgroup2 at /run/calico/cgroup. Calico-node initialisation is executed + # in best effort fashion, i.e. no failure for errors, to not disrupt pod creation in iptable mode. + - name: "mount-bpffs" + image: {{ calico_node_image_repo }}:{{ calico_node_image_tag }} imagePullPolicy: {{ k8s_image_pull_policy }} + command: ["calico-node", "-init", "-best-effort"] volumeMounts: - - name: flexvol-driver-host - mountPath: /host/driver + - mountPath: /sys/fs + name: sys-fs + # Bidirectional is required to ensure that the new mount we make at /sys/fs/bpf propagates to the host + # so that it outlives the init container. + mountPropagation: Bidirectional + - mountPath: /var/run/calico + name: var-run-calico + # Bidirectional is required to ensure that the new mount we make at /run/calico/cgroup propagates to the host + # so that it outlives the init container. + mountPropagation: Bidirectional + # Mount /proc/ from host which usually is an init program at /nodeproc. It's needed by mountns binary, + # executed by calico-node, to mount root cgroup2 fs at /run/calico/cgroup to attach CTLB programs correctly. + - mountPath: /nodeproc + name: nodeproc + readOnly: true securityContext: privileged: true containers: @@ -205,10 +232,7 @@ spec: key: calico_backend # Cluster type to identify the deployment type - name: CLUSTER_TYPE - valueFrom: - configMapKeyRef: - name: calico-config - key: cluster_type + value: "k8s,bgp" # Set noderef for node controller. - name: CALICO_K8S_NODE_REF valueFrom: @@ -230,14 +254,18 @@ spec: value: "{{ calico_iptables_backend }}" - name: FELIX_IPTABLESLOCKTIMEOUTSECS value: "{{ calico_iptables_lock_timeout_secs }}" -# should be set in etcd before deployment -# # Configure the IP Pool from which Pod IPs will be chosen. -# - name: CALICO_IPV4POOL_CIDR -# value: "{{ calico_pool_cidr | default(kube_pods_subnet) }}" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # - name: CALICO_IPV4POOL_CIDR + # value: "192.168.0.0/16" - name: CALICO_IPV4POOL_IPIP value: "{{ calico_ipv4pool_ipip }}" + # Enable or Disable VXLAN on the default IP pool. + - name: CALICO_IPV4POOL_VXLAN + value: "Never" - name: FELIX_IPV6SUPPORT - value: "{{ enable_dual_stack_networks | default(false) }}" + value: "{{ ipv6_stack | default(false) }}" # Set Felix logging to "info" - name: FELIX_LOGSEVERITYSCREEN value: "{{ calico_loglevel }}" @@ -280,9 +308,18 @@ spec: - name: IP_AUTODETECTION_METHOD value: "can-reach=$(NODEIP)" {% endif %} +{% if ipv4_stack %} - name: IP value: "autodetect" -{% if calico_ip6_auto_method is defined and enable_dual_stack_networks %} +{% else %} + - name: IP + value: none +{% endif %} +{% if ipv6_stack %} + - name: IP6 + value: autodetect +{% endif %} +{% if calico_ip6_auto_method is defined and ipv6_stack %} - name: IP6_AUTODETECTION_METHOD value: "{{ calico_ip6_auto_method }}" {% endif %} @@ -290,10 +327,6 @@ spec: - name: FELIX_MTUIFACEPATTERN value: "{{ calico_felix_mtu_iface_pattern }}" {% endif %} -{% if enable_dual_stack_networks %} - - name: IP6 - value: autodetect -{% endif %} {% if calico_use_default_route_src_ipaddr | default(false) %} - name: FELIX_DEVICEROUTESOURCEADDRESS valueFrom: @@ -324,7 +357,9 @@ spec: privileged: true resources: limits: +{% if calico_node_cpu_limit != "0" %} cpu: {{ calico_node_cpu_limit }} +{% endif %} memory: {{ calico_node_memory_limit }} requests: cpu: {{ calico_node_cpu_requests }} @@ -391,15 +426,10 @@ spec: {% endif %} - name: policysync mountPath: /var/run/nodeagent -{% if calico_bpf_enabled %} # For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the # parent directory. - - name: sysfs - mountPath: /sys/fs/ - # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host. - # If the host is known to mount that filesystem already then Bidirectional can be omitted. - mountPropagation: Bidirectional -{% endif %} + - name: bpffs + mountPath: /sys/fs/bpf - name: cni-log-dir mountPath: /var/log/calico/cni readOnly: true @@ -456,12 +486,18 @@ spec: hostPath: path: "/etc/kubernetes/ssl/" {% endif %} -{% if calico_bpf_enabled %} - - name: sysfs + - name: sys-fs hostPath: path: /sys/fs/ type: DirectoryOrCreate -{% endif %} + - name: bpffs + hostPath: + path: /sys/fs/bpf + type: Directory + # mount /proc at /nodeproc to be used by mount-bpffs initContainer to mount root cgroup2 fs. + - name: nodeproc + hostPath: + path: /proc # Used to access CNI logs. - name: cni-log-dir hostPath: @@ -471,12 +507,3 @@ spec: hostPath: type: DirectoryOrCreate path: /var/run/nodeagent - # Used to install Flex Volume Driver - - name: flexvol-driver-host - hostPath: - type: DirectoryOrCreate - path: "{{ kubelet_flexvolumes_plugins_dir | default('/usr/libexec/kubernetes/kubelet-plugins/volume/exec') }}/nodeagent~uds" - updateStrategy: - rollingUpdate: - maxUnavailable: {{ serial | default('20%') }} - type: RollingUpdate diff --git a/kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2 b/kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2 index d1f37aa..f2cf74f 100644 --- a/kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2 +++ b/kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2 @@ -126,6 +126,10 @@ spec: - name: TYPHA_PROMETHEUSMETRICSPORT value: "{{ typha_prometheusmetricsport }}" {% endif %} +{% if calico_ipam_host_local %} + - name: USE_POD_CIDR + value: "true" +{% endif %} {% if typha_secure %} volumeMounts: - mountPath: /etc/typha @@ -135,10 +139,6 @@ spec: subPath: ca.crt name: cacert readOnly: true -{% endif %} -{% if calico_ipam_host_local %} - - name: USE_POD_CIDR - value: "true" {% endif %} livenessProbe: httpGet: diff --git a/kubespray/project/roles/network_plugin/calico_defaults/defaults/main.yml b/kubespray/project/roles/network_plugin/calico_defaults/defaults/main.yml index 8b909f0..da89954 100644 --- a/kubespray/project/roles/network_plugin/calico_defaults/defaults/main.yml +++ b/kubespray/project/roles/network_plugin/calico_defaults/defaults/main.yml @@ -22,7 +22,7 @@ calico_pool_blocksize: 26 # Calico doesn't support ipip tunneling for the IPv6. calico_ipip_mode_ipv6: Never -calico_vxlan_mode_ipv6: Never +calico_vxlan_mode_ipv6: Always # add default ipv6 ippool blockSize calico_pool_blocksize_ipv6: 122 @@ -58,7 +58,7 @@ calico_felix_floating_ips: Disabled # Limits for apps calico_node_memory_limit: 500M -calico_node_cpu_limit: 300m +calico_node_cpu_limit: "0" calico_node_memory_requests: 64M calico_node_cpu_requests: 150m calico_felix_chaininsertmode: Insert diff --git a/kubespray/project/roles/network_plugin/cilium/defaults/main.yml b/kubespray/project/roles/network_plugin/cilium/defaults/main.yml index 7e65e7f..4f75d00 100644 --- a/kubespray/project/roles/network_plugin/cilium/defaults/main.yml +++ b/kubespray/project/roles/network_plugin/cilium/defaults/main.yml @@ -1,17 +1,17 @@ --- -cilium_min_version_required: "1.10" +cilium_min_version_required: "1.15" # Log-level cilium_debug: false -cilium_mtu: "" -cilium_enable_ipv4: true -cilium_enable_ipv6: false +cilium_mtu: "0" +cilium_enable_ipv4: "{{ ipv4_stack }}" +cilium_enable_ipv6: "{{ ipv6_stack }}" # Enable l2 announcement from cilium to replace Metallb Ref: https://docs.cilium.io/en/v1.14/network/l2-announcements/ cilium_l2announcements: false # Cilium agent health port -cilium_agent_health_port: "{%- if cilium_version | regex_replace('v') is version('1.11.6', '>=') -%}9879{%- else -%}9876{%- endif -%}" +cilium_agent_health_port: "9879" # Identity allocation mode selects how identities are shared between cilium # nodes by setting how they are stored. The options are "crd" or "kvstore". @@ -26,7 +26,7 @@ cilium_agent_health_port: "{%- if cilium_version | regex_replace('v') is version # - --synchronize-k8s-nodes # - --identity-allocation-mode=kvstore # - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations -cilium_identity_allocation_mode: kvstore +cilium_identity_allocation_mode: crd # Etcd SSL dirs cilium_cert_dir: /etc/cilium/certs @@ -46,30 +46,29 @@ cilium_tunnel_mode: vxlan # LoadBalancer Mode (snat/dsr/hybrid) Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#dsr-mode cilium_loadbalancer_mode: snat +# -- Configure Loadbalancer IP Pools +cilium_loadbalancer_ip_pools: [] + # Optional features cilium_enable_prometheus: false # Enable if you want to make use of hostPort mappings cilium_enable_portmap: false # Monitor aggregation level (none/low/medium/maximum) cilium_monitor_aggregation: medium -# Kube Proxy Replacement mode (strict/partial) -cilium_kube_proxy_replacement: partial +# Kube Proxy Replacement mode (true/false) +cilium_kube_proxy_replacement: false + +# If not defined `cilium_dns_proxy_enable_transparent_mode`, it will following the Cilium behavior. +# When Cilium is configured to replace kube-proxy, it automatically enables dnsProxy, which will conflict with nodelocaldns. +# You can set `false` avoid conflict with nodelocaldns. +# https://github.com/cilium/cilium/issues/33144 +# cilium_dns_proxy_enable_transparent_mode: # If upgrading from Cilium < 1.5, you may want to override some of these options # to prevent service disruptions. See also: # http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action cilium_preallocate_bpf_maps: false -# `cilium_tofqdns_enable_poller` is deprecated in 1.8, removed in 1.9 -cilium_tofqdns_enable_poller: false - -# `cilium_enable_legacy_services` is deprecated in 1.6, removed in 1.9 -cilium_enable_legacy_services: false - -# Deploy cilium even if kube_network_plugin is not cilium. -# This enables to deploy cilium alongside another CNI to replace kube-proxy. -cilium_deploy_additionally: false - # Auto direct nodes routes can be used to advertise pods routes in your cluster # without any tunelling (with `cilium_tunnel_mode` sets to `disabled`). # This works only if you have a L2 connectivity between all your nodes. @@ -101,8 +100,8 @@ cilium_encryption_enabled: false cilium_encryption_type: "ipsec" # Enable encryption for pure node to node traffic. -# This option is only effective when `cilium_encryption_type` is set to `ipsec`. -cilium_ipsec_node_encryption: false +# This option is only effective when `cilium_encryption_type` is set to `wireguard`. +cilium_encryption_node_encryption: false # If your kernel or distribution does not support WireGuard, Cilium agent can be configured to fall back on the user-space implementation. # When this flag is enabled and Cilium detects that the kernel has no native support for WireGuard, @@ -116,6 +115,7 @@ cilium_wireguard_userspace_fallback: false # In case they select the Pod at egress, then the bandwidth enforcement will be disabled for those Pods. # Bandwidth Manager requires a v5.1.x or more recent Linux kernel. cilium_enable_bandwidth_manager: false +cilium_enable_bandwidth_manager_bbr: false # IP Masquerade Agent # https://docs.cilium.io/en/stable/concepts/networking/masquerading/ @@ -138,16 +138,19 @@ cilium_non_masquerade_cidrs: ### Indicates whether to masquerade traffic to the link local prefix. ### If the masqLinkLocal is not set or set to false, then 169.254.0.0/16 is appended to the non-masquerade CIDRs list. cilium_masq_link_local: false +cilium_masq_link_local_ipv6: false ### A time interval at which the agent attempts to reload config from disk cilium_ip_masq_resync_interval: 60s # Hubble ### Enable Hubble without install cilium_enable_hubble: false -### Enable Hubble Metrics +### Enable Hubble-ui +cilium_enable_hubble_ui: "{{ cilium_enable_hubble }}" +### Enable Hubble Metrics (deprecated) cilium_enable_hubble_metrics: false ### if cilium_enable_hubble_metrics: true -cilium_hubble_metrics: {} +cilium_hubble_metrics: [] # - dns # - drop # - tcp @@ -159,12 +162,25 @@ cilium_hubble_install: false ### Enable auto generate certs if cilium_hubble_install: true cilium_hubble_tls_generate: false +cilium_hubble_export_file_max_backups: "5" +cilium_hubble_export_file_max_size_mb: "10" + +cilium_hubble_export_dynamic_enabled: false +cilium_hubble_export_dynamic_config_content: + - name: all + fieldMask: [] + includeFilters: [] + excludeFilters: [] + filePath: "/var/run/cilium/hubble/events.log" + ### Capacity of Hubble events buffer. The provided value must be one less than an integer power of two and no larger than 65535 ### (ie: 1, 3, ..., 2047, 4095, ..., 65535) (default 4095) # cilium_hubble_event_buffer_capacity: 4095 ### Buffer size of the channel to receive monitor events. # cilium_hubble_event_queue_size: 50 +cilium_gateway_api_enabled: false + # The default IP address management mode is "Cluster Scope". # https://docs.cilium.io/en/stable/concepts/networking/ipam/ cilium_ipam_mode: cluster-pool @@ -189,7 +205,8 @@ cilium_ipam_mode: cluster-pool # Extra arguments for the Cilium agent -cilium_agent_custom_args: [] +cilium_agent_custom_args: [] # deprecated +cilium_agent_extra_args: [] # For adding and mounting extra volumes to the cilium agent cilium_agent_extra_volumes: [] @@ -213,9 +230,19 @@ cilium_operator_extra_volumes: [] cilium_operator_extra_volume_mounts: [] # Extra arguments for the Cilium Operator -cilium_operator_custom_args: [] +cilium_operator_custom_args: [] # deprecated +cilium_operator_extra_args: [] +# Tolerations of the cilium operator +cilium_operator_tolerations: + - operator: "Exists" + +# Unique ID of the cluster. Must be unique across all connected +# clusters and in the range of 1 to 255. Only required for Cluster Mesh, +# may be 0 if Cluster Mesh is not used. +cilium_cluster_id: 0 # Name of the cluster. Only relevant when building a mesh of clusters. +# The "default" name cannot be used if the Cluster ID is different from 0. cilium_cluster_name: default # Make Cilium take ownership over the `/etc/cni/net.d` directory on the node, renaming all non-Cilium CNI configurations to `*.cilium_bak`. @@ -258,7 +285,7 @@ cilium_enable_bpf_masquerade: false # host stack (true) or directly and more efficiently out of BPF (false) if # the kernel supports it. The latter has the implication that it will also # bypass netfilter in the host namespace. -cilium_enable_host_legacy_routing: true +cilium_enable_host_legacy_routing: false # -- Enable use of the remote node identity. # ref: https://docs.cilium.io/en/v1.7/install/upgrade/#configmap-remote-node-identity @@ -275,6 +302,25 @@ cilium_monitor_aggregation_flags: "all" cilium_enable_bpf_clock_probe: true +# -- Enable BGP Control Plane +cilium_enable_bgp_control_plane: false + + +# -- Configure BGP Instances (New bgpv2 API v1.16+) +cilium_bgp_cluster_configs: [] + +# -- Configure BGP Peers (New bgpv2 API v1.16+) +cilium_bgp_peer_configs: [] + +# -- Configure BGP Advertisements (New bgpv2 API v1.16+) +cilium_bgp_advertisements: [] + +# -- Configure BGP Node Config Overrides (New bgpv2 API v1.16+) +cilium_bgp_node_config_overrides: [] + +# -- Configure BGP Peers (Legacy < v1.16) +cilium_bgp_peering_policies: [] + # -- Whether to enable CNP status updates. cilium_disable_cnp_status_updates: true @@ -283,9 +329,9 @@ cilium_rolling_restart_wait_retries_count: 30 cilium_rolling_restart_wait_retries_delay_seconds: 10 # Cilium changed the default metrics exporter ports in 1.12 -cilium_agent_scrape_port: "{{ cilium_version | regex_replace('v') is version('1.12', '>=') | ternary('9962', '9090') }}" -cilium_operator_scrape_port: "{{ cilium_version | regex_replace('v') is version('1.12', '>=') | ternary('9963', '6942') }}" -cilium_hubble_scrape_port: "{{ cilium_version | regex_replace('v') is version('1.12', '>=') | ternary('9965', '9091') }}" +cilium_agent_scrape_port: "9962" +cilium_operator_scrape_port: "9963" +cilium_hubble_scrape_port: "9965" # Cilium certgen args for generate certificate for hubble mTLS cilium_certgen_args: @@ -304,21 +350,5 @@ cilium_certgen_args: hubble-relay-client-cert-secret-name: hubble-relay-client-certs hubble-relay-server-cert-generate: false -# A list of extra rules variables to add to clusterrole for cilium operator, formatted like: -# cilium_clusterrole_rules_operator_extra_vars: -# - apiGroups: -# - '""' -# resources: -# - pods -# verbs: -# - delete -# - apiGroups: -# - '""' -# resources: -# - nodes -# verbs: -# - list -# - watch -# resourceNames: -# - toto -cilium_clusterrole_rules_operator_extra_vars: [] +cilium_enable_host_firewall: false +cilium_policy_audit_mode: false diff --git a/kubespray/project/roles/network_plugin/cilium/tasks/apply.yml b/kubespray/project/roles/network_plugin/cilium/tasks/apply.yml index 75868ba..04a761c 100644 --- a/kubespray/project/roles/network_plugin/cilium/tasks/apply.yml +++ b/kubespray/project/roles/network_plugin/cilium/tasks/apply.yml @@ -1,14 +1,7 @@ --- -- name: Cilium | Start Resources - kube: - name: "{{ item.item.name }}" - namespace: "kube-system" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/{{ item.item.name }}-{{ item.item.file }}" - state: "latest" - loop: "{{ cilium_node_manifests.results }}" - when: inventory_hostname == groups['kube_control_plane'][0] and not item is skipped +- name: Cilium | Install + command: "{{ bin_dir }}/cilium install --version {{ cilium_version }} -f {{ kube_config_dir }}/cilium-values.yaml" + when: inventory_hostname == groups['kube_control_plane'][0] - name: Cilium | Wait for pods to run command: "{{ kubectl }} -n kube-system get pods -l k8s-app=cilium -o jsonpath='{.items[?(@.status.containerStatuses[0].ready==false)].metadata.name}'" # noqa literal-compare @@ -19,15 +12,218 @@ failed_when: false when: inventory_hostname == groups['kube_control_plane'][0] -- name: Cilium | Hubble install - kube: - name: "{{ item.item.name }}" - namespace: "kube-system" - kubectl: "{{ bin_dir }}/kubectl" - resource: "{{ item.item.type }}" - filename: "{{ kube_config_dir }}/addons/hubble/{{ item.item.name }}-{{ item.item.file }}" - state: "latest" - loop: "{{ cilium_hubble_manifests.results }}" +- name: Cilium | Wait for CiliumLoadBalancerIPPool CRD to be present + command: "{{ kubectl }} wait --for condition=established --timeout=60s crd/ciliumloadbalancerippools.cilium.io" + register: cillium_lbippool_crd_ready + retries: "{{ cilium_rolling_restart_wait_retries_count | int }}" + delay: "{{ cilium_rolling_restart_wait_retries_delay_seconds | int }}" + failed_when: false when: - - inventory_hostname == groups['kube_control_plane'][0] and not item is skipped - - cilium_enable_hubble and cilium_hubble_install + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_loadbalancer_ip_pools is defined and (cilium_loadbalancer_ip_pools|length>0) + +- name: Cilium | Create CiliumLoadBalancerIPPool manifests + template: + src: "{{ item.name }}/{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + mode: "0644" + with_items: + - {name: cilium, file: cilium-loadbalancer-ip-pool.yml, type: CiliumLoadBalancerIPPool} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_lbippool_crd_ready is defined and cillium_lbippool_crd_ready.rc is defined and cillium_lbippool_crd_ready.rc == 0 + - cilium_loadbalancer_ip_pools is defined and (cilium_loadbalancer_ip_pools|length>0) + +- name: Cilium | Apply CiliumLoadBalancerIPPool from cilium_loadbalancer_ip_pools + kube: + name: "{{ item.name }}" + kubectl: "{{ bin_dir }}/kubectl" + resource: "{{ item.type }}" + filename: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + state: "latest" + loop: + - {name: cilium, file: cilium-loadbalancer-ip-pool.yml, type: CiliumLoadBalancerIPPool} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_lbippool_crd_ready is defined and cillium_lbippool_crd_ready.rc is defined and cillium_lbippool_crd_ready.rc == 0 + - cilium_loadbalancer_ip_pools is defined and (cilium_loadbalancer_ip_pools|length>0) + +- name: Cilium | Wait for CiliumBGPPeeringPolicy CRD to be present + command: "{{ kubectl }} wait --for condition=established --timeout=60s crd/ciliumbgppeeringpolicies.cilium.io" + register: cillium_bgpppolicy_crd_ready + retries: "{{ cilium_rolling_restart_wait_retries_count | int }}" + delay: "{{ cilium_rolling_restart_wait_retries_delay_seconds | int }}" + failed_when: false + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_peering_policies is defined and (cilium_bgp_peering_policies|length>0) + +- name: Cilium | Create CiliumBGPPeeringPolicy manifests + template: + src: "{{ item.name }}/{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + mode: "0644" + with_items: + - {name: cilium, file: cilium-bgp-peering-policy.yml, type: CiliumBGPPeeringPolicy} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgpppolicy_crd_ready is defined and cillium_bgpppolicy_crd_ready.rc is defined and cillium_bgpppolicy_crd_ready.rc == 0 + - cilium_bgp_peering_policies is defined and (cilium_bgp_peering_policies|length>0) + +- name: Cilium | Apply CiliumBGPPeeringPolicy from cilium_bgp_peering_policies + kube: + name: "{{ item.name }}" + kubectl: "{{ bin_dir }}/kubectl" + resource: "{{ item.type }}" + filename: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + state: "latest" + loop: + - {name: cilium, file: cilium-bgp-peering-policy.yml, type: CiliumBGPPeeringPolicy} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgpppolicy_crd_ready is defined and cillium_bgpppolicy_crd_ready.rc is defined and cillium_bgpppolicy_crd_ready.rc == 0 + - cilium_bgp_peering_policies is defined and (cilium_bgp_peering_policies|length>0) + +- name: Cilium | Wait for CiliumBGPClusterConfig CRD to be present + command: "{{ kubectl }} wait --for condition=established --timeout=60s crd/ciliumbgpclusterconfigs.cilium.io" + register: cillium_bgpcconfig_crd_ready + retries: "{{ cilium_rolling_restart_wait_retries_count | int }}" + delay: "{{ cilium_rolling_restart_wait_retries_delay_seconds | int }}" + failed_when: false + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_cluster_configs is defined and (cilium_bgp_cluster_configs|length>0) + +- name: Cilium | Create CiliumBGPClusterConfig manifests + template: + src: "{{ item.name }}/{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + mode: "0644" + with_items: + - {name: cilium, file: cilium-bgp-cluster-config.yml, type: CiliumBGPClusterConfig} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgpcconfig_crd_ready is defined and cillium_bgpcconfig_crd_ready.rc is defined and cillium_bgpcconfig_crd_ready.rc == 0 + - cilium_bgp_cluster_configs is defined and (cilium_bgp_cluster_configs|length>0) + +- name: Cilium | Apply CiliumBGPClusterConfig from cilium_bgp_cluster_configs + kube: + name: "{{ item.name }}" + kubectl: "{{ bin_dir }}/kubectl" + resource: "{{ item.type }}" + filename: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + state: "latest" + loop: + - {name: cilium, file: cilium-bgp-cluster-config.yml, type: CiliumBGPClusterConfig} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgpcconfig_crd_ready is defined and cillium_bgpcconfig_crd_ready.rc is defined and cillium_bgpcconfig_crd_ready.rc == 0 + - cilium_bgp_cluster_configs is defined and (cilium_bgp_cluster_configs|length>0) + +- name: Cilium | Wait for CiliumBGPPeerConfig CRD to be present + command: "{{ kubectl }} wait --for condition=established --timeout=60s crd/ciliumbgppeerconfigs.cilium.io" + register: cillium_bgppconfig_crd_ready + retries: "{{ cilium_rolling_restart_wait_retries_count | int }}" + delay: "{{ cilium_rolling_restart_wait_retries_delay_seconds | int }}" + failed_when: false + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_peer_configs is defined and (cilium_bgp_peer_configs|length>0) + +- name: Cilium | Create CiliumBGPPeerConfig manifests + template: + src: "{{ item.name }}/{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + mode: "0644" + with_items: + - {name: cilium, file: cilium-bgp-peer-config.yml, type: CiliumBGPPeerConfig} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgppconfig_crd_ready is defined and cillium_bgppconfig_crd_ready.rc is defined and cillium_bgppconfig_crd_ready.rc == 0 + - cilium_bgp_peer_configs is defined and (cilium_bgp_peer_configs|length>0) + +- name: Cilium | Apply CiliumBGPPeerConfig from cilium_bgp_peer_configs + kube: + name: "{{ item.name }}" + kubectl: "{{ bin_dir }}/kubectl" + resource: "{{ item.type }}" + filename: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + state: "latest" + loop: + - {name: cilium, file: cilium-bgp-peer-config.yml, type: CiliumBGPPeerConfig} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgppconfig_crd_ready is defined and cillium_bgppconfig_crd_ready.rc is defined and cillium_bgppconfig_crd_ready.rc == 0 + - cilium_bgp_peer_configs is defined and (cilium_bgp_peer_configs|length>0) + +- name: Cilium | Wait for CiliumBGPAdvertisement CRD to be present + command: "{{ kubectl }} wait --for condition=established --timeout=60s crd/ciliumbgpadvertisements.cilium.io" + register: cillium_bgpadvert_crd_ready + retries: "{{ cilium_rolling_restart_wait_retries_count | int }}" + delay: "{{ cilium_rolling_restart_wait_retries_delay_seconds | int }}" + failed_when: false + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_advertisements is defined and (cilium_bgp_advertisements|length>0) + +- name: Cilium | Create CiliumBGPAdvertisement manifests + template: + src: "{{ item.name }}/{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + mode: "0644" + with_items: + - {name: cilium, file: cilium-bgp-advertisement.yml, type: CiliumBGPAdvertisement} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgpadvert_crd_ready is defined and cillium_bgpadvert_crd_ready.rc is defined and cillium_bgpadvert_crd_ready.rc == 0 + - cilium_bgp_advertisements is defined and (cilium_bgp_advertisements|length>0) + +- name: Cilium | Apply CiliumBGPAdvertisement from cilium_bgp_advertisements + kube: + name: "{{ item.name }}" + kubectl: "{{ bin_dir }}/kubectl" + resource: "{{ item.type }}" + filename: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + state: "latest" + loop: + - {name: cilium, file: cilium-bgp-advertisement.yml, type: CiliumBGPAdvertisement} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cillium_bgpadvert_crd_ready is defined and cillium_bgpadvert_crd_ready.rc is defined and cillium_bgpadvert_crd_ready.rc == 0 + - cilium_bgp_advertisements is defined and (cilium_bgp_advertisements|length>0) + +- name: Cilium | Wait for CiliumBGPNodeConfigOverride CRD to be present + command: "{{ kubectl }} wait --for condition=established --timeout=60s crd/ciliumbgpnodeconfigoverrides.cilium.io" + register: cilium_bgp_node_config_crd_ready + retries: "{{ cilium_rolling_restart_wait_retries_count | int }}" + delay: "{{ cilium_rolling_restart_wait_retries_delay_seconds | int }}" + failed_when: false + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_advertisements is defined and (cilium_bgp_advertisements|length>0) + +- name: Cilium | Create CiliumBGPNodeConfigOverride manifests + template: + src: "{{ item.name }}/{{ item.file }}.j2" + dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + mode: "0644" + with_items: + - {name: cilium, file: cilium-bgp-node-config-override.yml, type: CiliumBGPNodeConfigOverride} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_node_config_crd_ready is defined and cilium_bgp_node_config_crd_ready.rc is defined and cilium_bgp_node_config_crd_ready.rc == 0 + - cilium_bgp_node_config_overrides is defined and (cilium_bgp_node_config_overrides|length>0) + +- name: Cilium | Apply CiliumBGPNodeConfigOverride from cilium_bgp_node_config_overrides + kube: + name: "{{ item.name }}" + kubectl: "{{ bin_dir }}/kubectl" + resource: "{{ item.type }}" + filename: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" + state: "latest" + loop: + - {name: cilium, file: cilium-bgp-node-config-override.yml, type: CiliumBGPNodeConfigOverride} + when: + - inventory_hostname == groups['kube_control_plane'][0] + - cilium_bgp_node_config_crd_ready is defined and cilium_bgp_node_config_crd_ready.rc is defined and cilium_bgp_node_config_crd_ready.rc == 0 + - cilium_bgp_node_config_overrides is defined and (cilium_bgp_node_config_overrides|length>0) diff --git a/kubespray/project/roles/network_plugin/cilium/tasks/check.yml b/kubespray/project/roles/network_plugin/cilium/tasks/check.yml index 34a5afe..7471fe3 100644 --- a/kubespray/project/roles/network_plugin/cilium/tasks/check.yml +++ b/kubespray/project/roles/network_plugin/cilium/tasks/check.yml @@ -18,13 +18,13 @@ when: - cilium_ipsec_enabled is defined - cilium_ipsec_enabled - - kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin == 'cilium' or cilium_deploy_additionally - name: Stop if kernel version is too low for Cilium Wireguard encryption assert: that: ansible_kernel.split('-')[0] is version('5.6.0', '>=') when: - - kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool + - kube_network_plugin == 'cilium' or cilium_deploy_additionally - cilium_encryption_enabled - cilium_encryption_type == "wireguard" - not ignore_assert_errors @@ -48,9 +48,9 @@ msg: "cilium_encryption_type must be either 'ipsec' or 'wireguard'" when: cilium_encryption_enabled -- name: Stop if cilium_version is < v1.10.0 +- name: Stop if cilium_version is < {{ cilium_min_version_required }} assert: - that: cilium_version | regex_replace('v') is version(cilium_min_version_required, '>=') + that: cilium_version is version(cilium_min_version_required, '>=') msg: "cilium_version is too low. Minimum version {{ cilium_min_version_required }}" # TODO: Clean this task up when we drop backward compatibility support for `cilium_ipsec_enabled` diff --git a/kubespray/project/roles/network_plugin/cilium/tasks/install.yml b/kubespray/project/roles/network_plugin/cilium/tasks/install.yml index 7da3964..783891d 100644 --- a/kubespray/project/roles/network_plugin/cilium/tasks/install.yml +++ b/kubespray/project/roles/network_plugin/cilium/tasks/install.yml @@ -30,58 +30,6 @@ when: - cilium_identity_allocation_mode == "kvstore" -- name: Cilium | Create hubble dir - file: - path: "{{ kube_config_dir }}/addons/hubble" - state: directory - owner: root - group: root - mode: "0755" - when: - - inventory_hostname == groups['kube_control_plane'][0] - - cilium_hubble_install - -- name: Cilium | Create Cilium node manifests - template: - src: "{{ item.name }}/{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.name }}-{{ item.file }}" - mode: "0644" - loop: - - {name: cilium, file: config.yml, type: cm} - - {name: cilium-operator, file: crb.yml, type: clusterrolebinding} - - {name: cilium-operator, file: cr.yml, type: clusterrole} - - {name: cilium, file: crb.yml, type: clusterrolebinding} - - {name: cilium, file: cr.yml, type: clusterrole} - - {name: cilium, file: secret.yml, type: secret, when: "{{ cilium_encryption_enabled and cilium_encryption_type == 'ipsec' }}"} - - {name: cilium, file: ds.yml, type: ds} - - {name: cilium-operator, file: deploy.yml, type: deploy} - - {name: cilium-operator, file: sa.yml, type: sa} - - {name: cilium, file: sa.yml, type: sa} - register: cilium_node_manifests - when: - - inventory_hostname in groups['kube_control_plane'] - - item.when | default(True) | bool - -- name: Cilium | Create Cilium Hubble manifests - template: - src: "{{ item.name }}/{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/addons/hubble/{{ item.name }}-{{ item.file }}" - mode: "0644" - loop: - - {name: hubble, file: config.yml, type: cm} - - {name: hubble, file: crb.yml, type: clusterrolebinding} - - {name: hubble, file: cr.yml, type: clusterrole} - - {name: hubble, file: cronjob.yml, type: cronjob, when: "{{ cilium_hubble_tls_generate }}"} - - {name: hubble, file: deploy.yml, type: deploy} - - {name: hubble, file: job.yml, type: job, when: "{{ cilium_hubble_tls_generate }}"} - - {name: hubble, file: sa.yml, type: sa} - - {name: hubble, file: service.yml, type: service} - register: cilium_hubble_manifests - when: - - inventory_hostname == groups['kube_control_plane'][0] - - cilium_enable_hubble and cilium_hubble_install - - item.when | default(True) | bool - - name: Cilium | Enable portmap addon template: src: 000-cilium-portmap.conflist.j2 @@ -89,6 +37,14 @@ mode: "0644" when: cilium_enable_portmap +- name: Cilium | Render values + template: + src: values.yaml.j2 + dest: "{{ kube_config_dir }}/cilium-values.yaml" + mode: "0644" + when: + - inventory_hostname == groups['kube_control_plane'][0] + - name: Cilium | Copy Ciliumcli binary from download dir copy: src: "{{ local_release_dir }}/cilium" diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/cr.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/cr.yml.j2 deleted file mode 100644 index 5bcc44d..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/cr.yml.j2 +++ /dev/null @@ -1,188 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cilium-operator -rules: -- apiGroups: - - "" - resources: - # to automatically delete [core|kube]dns pods so that are starting to being - # managed by Cilium - - pods - verbs: - - get - - list - - watch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - list - - watch -- apiGroups: - - "" - resources: - # To remove node taints - - nodes - # To set NetworkUnavailable false on startup - - nodes/status - verbs: - - patch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - # to perform LB IP allocation for BGP - - services/status - verbs: - - update - - patch -- apiGroups: - - "" - resources: - # to perform the translation of a CNP that contains `ToGroup` to its endpoints - - services - - endpoints - # to check apiserver connectivity - - namespaces - verbs: - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumnetworkpolicies - - ciliumnetworkpolicies/status - - ciliumnetworkpolicies/finalizers - - ciliumclusterwidenetworkpolicies - - ciliumclusterwidenetworkpolicies/status - - ciliumclusterwidenetworkpolicies/finalizers - - ciliumendpoints - - ciliumendpoints/status - - ciliumendpoints/finalizers - - ciliumnodes - - ciliumnodes/status - - ciliumnodes/finalizers - - ciliumidentities - - ciliumidentities/status - - ciliumidentities/finalizers - - ciliumlocalredirectpolicies - - ciliumlocalredirectpolicies/status - - ciliumlocalredirectpolicies/finalizers -{% if cilium_version | regex_replace('v') is version('1.11', '>=') %} - - ciliumendpointslices -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.12', '>=') %} - - ciliumbgploadbalancerippools - - ciliumloadbalancerippools - - ciliumloadbalancerippools/status - - ciliumbgppeeringpolicies - - ciliumenvoyconfigs -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.15', '>=') %} - - ciliumbgppeerconfigs - - ciliumbgpadvertisements - - ciliumbgpnodeconfigs -{% endif %} - verbs: - - '*' -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - create - - get - - list - - update - - watch -# For cilium-operator running in HA mode. -# -# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election -# between multiple running instances. -# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less -# common and fewer objects in the cluster watch "all Leases". -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - get - - update -{% if cilium_version | regex_replace('v') is version('1.12', '>=') %} -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - update - resourceNames: - - ciliumbgploadbalancerippools.cilium.io - - ciliumbgppeeringpolicies.cilium.io - - ciliumclusterwideenvoyconfigs.cilium.io - - ciliumclusterwidenetworkpolicies.cilium.io - - ciliumegressgatewaypolicies.cilium.io - - ciliumegressnatpolicies.cilium.io - - ciliumendpoints.cilium.io - - ciliumendpointslices.cilium.io - - ciliumenvoyconfigs.cilium.io - - ciliumexternalworkloads.cilium.io - - ciliumidentities.cilium.io - - ciliumlocalredirectpolicies.cilium.io - - ciliumnetworkpolicies.cilium.io - - ciliumnodes.cilium.io -{% if cilium_version | regex_replace('v') is version('1.14', '>=') %} - - ciliumnodeconfigs.cilium.io - - ciliumcidrgroups.cilium.io - - ciliuml2announcementpolicies.cilium.io - - ciliumpodippools.cilium.io - - ciliumloadbalancerippools.cilium.io -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.15', '>=') %} - - ciliumbgpclusterconfigs.cilium.io - - ciliumbgppeerconfigs.cilium.io - - ciliumbgpadvertisements.cilium.io - - ciliumbgpnodeconfigs.cilium.io - - ciliumbgpnodeconfigoverrides.cilium.io -{% endif %} -{% endif %} -{% for rules in cilium_clusterrole_rules_operator_extra_vars %} -- apiGroups: -{% for api in rules['apiGroups'] %} - - {{ api }} -{% endfor %} - resources: -{% for resource in rules['resources'] %} - - {{ resource }} -{% endfor %} - verbs: -{% for verb in rules['verbs'] %} - - {{ verb }} -{% endfor %} -{% if 'resourceNames' in rules %} - resourceNames: -{% for resourceName in rules['resourceNames'] %} - - {{ resourceName }} -{% endfor %} -{% endif %} -{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/crb.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/crb.yml.j2 deleted file mode 100644 index 00f0835..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/crb.yml.j2 +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cilium-operator -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium-operator -subjects: -- kind: ServiceAccount - name: cilium-operator - namespace: kube-system diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/deploy.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/deploy.yml.j2 deleted file mode 100644 index 1418965..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/deploy.yml.j2 +++ /dev/null @@ -1,170 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cilium-operator - namespace: kube-system - labels: - io.cilium/app: operator - name: cilium-operator -spec: -{% if groups.k8s_cluster | length == 1 %} - replicas: 1 -{% else %} - replicas: {{ cilium_operator_replicas }} -{% endif %} - selector: - matchLabels: - io.cilium/app: operator - name: cilium-operator - strategy: - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - type: RollingUpdate - template: - metadata: -{% if cilium_enable_prometheus %} - annotations: - prometheus.io/port: "{{ cilium_operator_scrape_port }}" - prometheus.io/scrape: "true" -{% endif %} - labels: - io.cilium/app: operator - name: cilium-operator - spec: - containers: - - name: cilium-operator - image: "{{ cilium_operator_image_repo }}:{{ cilium_operator_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - cilium-operator - args: - - --config-dir=/tmp/cilium/config-map - - --debug=$(CILIUM_DEBUG) -{% if cilium_operator_custom_args is string %} - - {{ cilium_operator_custom_args }} -{% else %} -{% for flag in cilium_operator_custom_args %} - - {{ flag }} -{% endfor %} -{% endif %} - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: CILIUM_DEBUG - valueFrom: - configMapKeyRef: - key: debug - name: cilium-config - optional: true - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: cilium-aws - key: AWS_ACCESS_KEY_ID - optional: true - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: cilium-aws - key: AWS_SECRET_ACCESS_KEY - optional: true - - name: AWS_DEFAULT_REGION - valueFrom: - secretKeyRef: - name: cilium-aws - key: AWS_DEFAULT_REGION - optional: true -{% if cilium_kube_proxy_replacement == 'strict' %} - - name: KUBERNETES_SERVICE_HOST - value: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}" - - name: KUBERNETES_SERVICE_PORT - value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}" -{% endif %} -{% if cilium_enable_prometheus %} - - name: POD_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - ports: - - name: prometheus - containerPort: {{ cilium_operator_scrape_port }} - hostPort: {{ cilium_operator_scrape_port }} - protocol: TCP -{% endif %} - livenessProbe: - httpGet: -{% if cilium_enable_ipv4 %} - host: 127.0.0.1 -{% else %} - host: '::1' -{% endif %} - path: /healthz - port: 9234 - scheme: HTTP - initialDelaySeconds: 60 - periodSeconds: 10 - timeoutSeconds: 3 - volumeMounts: - - name: cilium-config-path - mountPath: /tmp/cilium/config-map - readOnly: true -{% if cilium_identity_allocation_mode == "kvstore" %} - - name: etcd-config-path - mountPath: /var/lib/etcd-config - readOnly: true - - name: etcd-secrets - mountPath: "{{ cilium_cert_dir }}" - readOnly: true -{% endif %} -{% for volume_mount in cilium_operator_extra_volume_mounts %} - - {{ volume_mount | to_nice_yaml(indent=2) | indent(14) }} -{% endfor %} - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet - restartPolicy: Always - priorityClassName: system-node-critical - serviceAccount: cilium-operator - serviceAccountName: cilium-operator - # In HA mode, cilium-operator pods must not be scheduled on the same - # node as they will clash with each other. - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - topologyKey: kubernetes.io/hostname - labelSelector: - matchLabels: - io.cilium/app: operator - tolerations: - - operator: Exists - volumes: - - name: cilium-config-path - configMap: - name: cilium-config -{% if cilium_identity_allocation_mode == "kvstore" %} - # To read the etcd config stored in config maps - - name: etcd-config-path - configMap: - name: cilium-config - defaultMode: 420 - items: - - key: etcd-config - path: etcd.config - # To read the k8s etcd secrets in case the user might want to use TLS - - name: etcd-secrets - hostPath: - path: "{{ cilium_cert_dir }}" -{% endif %} -{% for volume in cilium_operator_extra_volumes %} - - {{ volume | to_nice_yaml(indent=2) | indent(10) }} -{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/sa.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/sa.yml.j2 deleted file mode 100644 index c5d1893..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium-operator/sa.yml.j2 +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cilium-operator - namespace: kube-system diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2 new file mode 100644 index 0000000..f21f381 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-advertisement.yml.j2 @@ -0,0 +1,12 @@ +{% for cilium_bgp_advertisement in cilium_bgp_advertisements %} +--- +apiVersion: "cilium.io/v2alpha1" +kind: CiliumBGPAdvertisement +metadata: + name: "{{ cilium_bgp_advertisement.name }}" +{% if cilium_bgp_advertisement.labels %} + labels: {{ cilium_bgp_advertisement.labels | to_yaml }} +{% endif %} +spec: + {{ cilium_bgp_advertisement.spec | to_yaml | indent(4) }} +{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-cluster-config.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-cluster-config.yml.j2 new file mode 100644 index 0000000..1de3472 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-cluster-config.yml.j2 @@ -0,0 +1,9 @@ +{% for cilium_bgp_cluster_config in cilium_bgp_cluster_configs %} +--- +apiVersion: "cilium.io/v2alpha1" +kind: CiliumBGPClusterConfig +metadata: + name: "{{ cilium_bgp_cluster_config.name }}" +spec: + {{ cilium_bgp_cluster_config.spec | to_yaml | indent(2) }} +{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-node-config-override.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-node-config-override.yml.j2 new file mode 100644 index 0000000..e873cf5 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-node-config-override.yml.j2 @@ -0,0 +1,9 @@ +{% for cilium_bgp_node_config_override in cilium_bgp_node_config_overrides %} +--- +apiVersion: "cilium.io/v2alpha1" +kind: CiliumBGPNodeConfigOverride +metadata: + name: "{{ cilium_bgp_node_config_override.name }}" +spec: + {{ cilium_bgp_node_config_override.spec | to_yaml | indent(2) }} +{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peer-config.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peer-config.yml.j2 new file mode 100644 index 0000000..aa137c9 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peer-config.yml.j2 @@ -0,0 +1,9 @@ +{% for cilium_bgp_peer_config in cilium_bgp_peer_configs %} +--- +apiVersion: "cilium.io/v2alpha1" +kind: CiliumBGPPeerConfig +metadata: + name: "{{ cilium_bgp_peer_config.name }}" +spec: + {{ cilium_bgp_peer_config.spec | to_yaml | indent(2) }} +{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peering-policy.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peering-policy.yml.j2 new file mode 100644 index 0000000..fc90862 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-bgp-peering-policy.yml.j2 @@ -0,0 +1,9 @@ +{% for cilium_bgp_peering_policy in cilium_bgp_peering_policies %} +--- +apiVersion: "cilium.io/v2alpha1" +kind: CiliumBGPPeeringPolicy +metadata: + name: "{{ cilium_bgp_peering_policy.name }}" +spec: + {{ cilium_bgp_peering_policy.spec | to_yaml | indent(2) }} +{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-loadbalancer-ip-pool.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-loadbalancer-ip-pool.yml.j2 new file mode 100644 index 0000000..8a2a840 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cilium-loadbalancer-ip-pool.yml.j2 @@ -0,0 +1,16 @@ +{% for cilium_loadbalancer_ip_pool in cilium_loadbalancer_ip_pools %} +--- +apiVersion: "cilium.io/v2alpha1" +kind: CiliumLoadBalancerIPPool +metadata: + name: "{{ cilium_loadbalancer_ip_pool.name }}" +spec: + blocks: +{% for cblock in cilium_loadbalancer_ip_pool.cidrs | default([]) %} + - cidr: "{{ cblock }}" +{% endfor %} +{% for rblock in cilium_loadbalancer_ip_pool.ranges | default([]) %} + - start: "{{ rblock.start }}" + stop: "{{ rblock.stop | default(rblock.start) }}" +{% endfor %} +{% endfor %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/config.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/config.yml.j2 deleted file mode 100644 index ed37f12..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium/config.yml.j2 +++ /dev/null @@ -1,282 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: cilium-config - namespace: kube-system -data: - identity-allocation-mode: {{ cilium_identity_allocation_mode }} - -{% if cilium_identity_allocation_mode == "kvstore" %} - # This etcd-config contains the etcd endpoints of your cluster. If you use - # TLS please make sure you follow the tutorial in https://cilium.link/etcd-config - etcd-config: |- - --- - endpoints: -{% for ip_addr in etcd_access_addresses.split(',') %} - - {{ ip_addr }} -{% endfor %} - - # In case you want to use TLS in etcd, uncomment the 'ca-file' line - # and create a kubernetes secret by following the tutorial in - # https://cilium.link/etcd-config - ca-file: "{{ cilium_cert_dir }}/ca_cert.crt" - - # In case you want client to server authentication, uncomment the following - # lines and create a kubernetes secret by following the tutorial in - # https://cilium.link/etcd-config - key-file: "{{ cilium_cert_dir }}/key.pem" - cert-file: "{{ cilium_cert_dir }}/cert.crt" - - # kvstore - # https://docs.cilium.io/en/latest/cmdref/kvstore/ - kvstore: etcd - kvstore-opt: '{"etcd.config": "/var/lib/etcd-config/etcd.config"}' -{% endif %} - - # If you want metrics enabled in all of your Cilium agents, set the port for - # which the Cilium agents will have their metrics exposed. - # This option deprecates the "prometheus-serve-addr" in the - # "cilium-metrics-config" ConfigMap - # NOTE that this will open the port on ALL nodes where Cilium pods are - # scheduled. -{% if cilium_enable_prometheus %} - prometheus-serve-addr: ":{{ cilium_agent_scrape_port }}" - operator-prometheus-serve-addr: ":{{ cilium_operator_scrape_port }}" - enable-metrics: "true" -{% endif %} - - # If you want to run cilium in debug mode change this value to true - debug: "{{ cilium_debug }}" - enable-ipv4: "{{ cilium_enable_ipv4 }}" - enable-ipv6: "{{ cilium_enable_ipv6 }}" - # If a serious issue occurs during Cilium startup, this - # invasive option may be set to true to remove all persistent - # state. Endpoints will not be restored using knowledge from a - # prior Cilium run, so they may receive new IP addresses upon - # restart. This also triggers clean-cilium-bpf-state. - clean-cilium-state: "false" - # If you want to clean cilium BPF state, set this to true; - # Removes all BPF maps from the filesystem. Upon restart, - # endpoints are restored with the same IP addresses, however - # any ongoing connections may be disrupted briefly. - # Loadbalancing decisions will be reset, so any ongoing - # connections via a service may be loadbalanced to a different - # backend after restart. - clean-cilium-bpf-state: "false" - - # Users who wish to specify their own custom CNI configuration file must set - # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration. - custom-cni-conf: "false" - -{% if cilium_version | regex_replace('v') is version('1.14.0', '>=') %} - # Tell the agent to generate and write a CNI configuration file - write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist - cni-exclusive: "{{ cilium_cni_exclusive }}" - cni-log-file: "{{ cilium_cni_log_file }}" -{% endif %} - - # If you want cilium monitor to aggregate tracing for packets, set this level - # to "low", "medium", or "maximum". The higher the level, the less packets - # that will be seen in monitor output. - monitor-aggregation: "{{ cilium_monitor_aggregation }}" - - # ct-global-max-entries-* specifies the maximum number of connections - # supported across all endpoints, split by protocol: tcp or other. One pair - # of maps uses these values for IPv4 connections, and another pair of maps - # use these values for IPv6 connections. - # - # If these values are modified, then during the next Cilium startup the - # tracking of ongoing connections may be disrupted. This may lead to brief - # policy drops or a change in loadbalancing decisions for a connection. - # - # For users upgrading from Cilium 1.2 or earlier, to minimize disruption - # during the upgrade process, comment out these options. - bpf-ct-global-tcp-max: "524288" - bpf-ct-global-any-max: "262144" - - # Pre-allocation of map entries allows per-packet latency to be reduced, at - # the expense of up-front memory allocation for the entries in the maps. The - # default value below will minimize memory usage in the default installation; - # users who are sensitive to latency may consider setting this to "true". - # - # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore - # this option and behave as though it is set to "true". - # - # If this value is modified, then during the next Cilium startup the restore - # of existing endpoints and tracking of ongoing connections may be disrupted. - # This may lead to policy drops or a change in loadbalancing decisions for a - # connection for some time. Endpoints may need to be recreated to restore - # connectivity. - # - # If this option is set to "false" during an upgrade from 1.3 or earlier to - # 1.4 or later, then it may cause one-time disruptions during the upgrade. - preallocate-bpf-maps: "{{ cilium_preallocate_bpf_maps }}" - - # Regular expression matching compatible Istio sidecar istio-proxy - # container image names - sidecar-istio-proxy-image: "cilium/istio_proxy" - - # Encapsulation mode for communication between nodes - # Possible values: - # - disabled - # - vxlan (default) - # - geneve -{% if cilium_version | regex_replace('v') is version('1.14.0', '<') %} - tunnel: "{{ cilium_tunnel_mode }}" -{% elif cilium_version | regex_replace('v') is version('1.14.0', '>=') and cilium_tunnel_mode == 'disabled' %} - routing-mode: 'native' -{% elif cilium_version | regex_replace('v') is version('1.14.0', '>=') and cilium_tunnel_mode != 'disabled' %} - routing-mode: 'tunnel' - tunnel-protocol: "{{ cilium_tunnel_mode }}" -{% endif %} - - ## DSR setting - bpf-lb-mode: "{{ cilium_loadbalancer_mode }}" - - # l2 - enable-l2-announcements: "{{ cilium_l2announcements }}" - - # Enable Bandwidth Manager - # Cilium’s bandwidth manager supports the kubernetes.io/egress-bandwidth Pod annotation. - # Bandwidth enforcement currently does not work in combination with L7 Cilium Network Policies. - # In case they select the Pod at egress, then the bandwidth enforcement will be disabled for those Pods. - # Bandwidth Manager requires a v5.1.x or more recent Linux kernel. -{% if cilium_enable_bandwidth_manager %} - enable-bandwidth-manager: "true" -{% endif %} - - # Name of the cluster. Only relevant when building a mesh of clusters. - cluster-name: "{{ cilium_cluster_name }}" - - # Unique ID of the cluster. Must be unique across all conneted clusters and - # in the range of 1 and 255. Only relevant when building a mesh of clusters. - #cluster-id: 1 -{% if cilium_cluster_id is defined %} - cluster-id: "{{ cilium_cluster_id }}" -{% endif %} - -# `wait-bpf-mount` is removed after v1.10.4 -# https://github.com/cilium/cilium/commit/d2217045cb3726a7f823174e086913b69b8090da -{% if cilium_version | regex_replace('v') is version('1.10.4', '<') %} - # wait-bpf-mount makes init container wait until bpf filesystem is mounted - wait-bpf-mount: "false" -{% endif %} - - kube-proxy-replacement: "{{ cilium_kube_proxy_replacement }}" - -# `native-routing-cidr` is deprecated in 1.10, removed in 1.12. -# Replaced by `ipv4-native-routing-cidr` -# https://github.com/cilium/cilium/pull/16695 -{% if cilium_version | regex_replace('v') is version('1.12', '<') %} - native-routing-cidr: "{{ cilium_native_routing_cidr }}" -{% else %} -{% if cilium_native_routing_cidr | length %} - ipv4-native-routing-cidr: "{{ cilium_native_routing_cidr }}" -{% endif %} -{% if cilium_native_routing_cidr_ipv6 | length %} - ipv6-native-routing-cidr: "{{ cilium_native_routing_cidr_ipv6 }}" -{% endif %} -{% endif %} - - auto-direct-node-routes: "{{ cilium_auto_direct_node_routes }}" - - operator-api-serve-addr: "{{ cilium_operator_api_serve_addr }}" - - # Hubble settings -{% if cilium_enable_hubble %} - enable-hubble: "true" -{% if cilium_enable_hubble_metrics %} - hubble-metrics-server: ":{{ cilium_hubble_scrape_port }}" - hubble-metrics: -{% for hubble_metrics_cycle in cilium_hubble_metrics %} - {{ hubble_metrics_cycle }} -{% endfor %} -{% endif %} -{% if cilium_hubble_event_buffer_capacity is defined %} - hubble-event-buffer-capacity: "{{ cilium_hubble_event_buffer_capacity }}" -{% endif %} -{% if cilium_hubble_event_queue_size is defined %} - hubble-event-queue-size: "{{ cilium_hubble_event_queue_size }}" -{% endif %} - hubble-listen-address: ":4244" -{% if cilium_enable_hubble and cilium_hubble_install %} - hubble-disable-tls: "{% if cilium_hubble_tls_generate %}false{% else %}true{% endif %}" - hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt - hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key - hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt -{% endif %} -{% endif %} - - # IP Masquerade Agent - enable-ip-masq-agent: "{{ cilium_ip_masq_agent_enable }}" - -{% for key, value in cilium_config_extra_vars.items() %} - {{ key }}: "{{ value }}" -{% endfor %} - - # Enable transparent network encryption -{% if cilium_encryption_enabled %} -{% if cilium_encryption_type == "ipsec" %} - enable-ipsec: "true" - ipsec-key-file: /etc/ipsec/keys - encrypt-node: "{{ cilium_ipsec_node_encryption }}" -{% endif %} - -{% if cilium_encryption_type == "wireguard" %} - enable-wireguard: "true" - enable-wireguard-userspace-fallback: "{{ cilium_wireguard_userspace_fallback }}" -{% endif %} -{% endif %} - - # IPAM settings - ipam: "{{ cilium_ipam_mode }}" -{% if cilium_ipam_mode == "cluster-pool" %} - cluster-pool-ipv4-cidr: "{{ cilium_pool_cidr | default(kube_pods_subnet) }}" - cluster-pool-ipv4-mask-size: "{{ cilium_pool_mask_size | default(kube_network_node_prefix) }}" -{% if cilium_enable_ipv6 %} - cluster-pool-ipv6-cidr: "{{ cilium_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6) }}" - cluster-pool-ipv6-mask-size: "{{ cilium_pool_mask_size_ipv6 | default(kube_network_node_prefix_ipv6) }}" -{% endif %} -{% endif %} - - agent-health-port: "{{ cilium_agent_health_port }}" - -{% if cilium_version | regex_replace('v') is version('1.11', '>=') and cilium_cgroup_host_root != '' %} - cgroup-root: "{{ cilium_cgroup_host_root }}" -{% endif %} - - bpf-map-dynamic-size-ratio: "{{ cilium_bpf_map_dynamic_size_ratio }}" - - enable-ipv4-masquerade: "{{ cilium_enable_ipv4_masquerade }}" - enable-ipv6-masquerade: "{{ cilium_enable_ipv6_masquerade }}" - - enable-bpf-masquerade: "{{ cilium_enable_bpf_masquerade }}" - - enable-host-legacy-routing: "{{ cilium_enable_host_legacy_routing }}" - - enable-remote-node-identity: "{{ cilium_enable_remote_node_identity }}" - - enable-well-known-identities: "{{ cilium_enable_well_known_identities }}" - - monitor-aggregation-flags: "{{ cilium_monitor_aggregation_flags }}" - - enable-bpf-clock-probe: "{{ cilium_enable_bpf_clock_probe }}" - - disable-cnp-status-updates: "{{ cilium_disable_cnp_status_updates }}" -{% if cilium_ip_masq_agent_enable %} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: ip-masq-agent - namespace: kube-system -data: - config: | - nonMasqueradeCIDRs: -{% for cidr in cilium_non_masquerade_cidrs %} - - {{ cidr }} -{% endfor %} - masqLinkLocal: {{ cilium_masq_link_local | bool }} - resyncInterval: "{{ cilium_ip_masq_resync_interval }}" -{% endif %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cr.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/cr.yml.j2 deleted file mode 100644 index 833076d..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium/cr.yml.j2 +++ /dev/null @@ -1,155 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cilium -rules: -- apiGroups: - - networking.k8s.io - resources: - - networkpolicies - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - namespaces - - services - - pods - - endpoints - - nodes - verbs: - - get - - list - - watch -{% if cilium_version | regex_replace('v') is version('1.12', '<') %} -- apiGroups: - - "" - resources: - - pods - - pods/finalizers - verbs: - - get - - list - - watch - - update - - delete -- apiGroups: - - "" - resources: - - pods - - nodes - verbs: - - get - - list - - watch - - update -{% endif %} -- apiGroups: - - "" - resources: - - nodes - - nodes/status - verbs: - - patch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - # Deprecated for removal in v1.10 - - create - - list - - watch - - update - - # This is used when validating policies in preflight. This will need to stay - # until we figure out how to avoid "get" inside the preflight, and then - # should be removed ideally. - - get -- apiGroups: - - cilium.io - resources: - - ciliumnetworkpolicies - - ciliumnetworkpolicies/status - - ciliumclusterwidenetworkpolicies - - ciliumclusterwidenetworkpolicies/status - - ciliumendpoints - - ciliumendpoints/status - - ciliumnodes - - ciliumnodes/status - - ciliumidentities - - ciliumlocalredirectpolicies - - ciliumlocalredirectpolicies/status - - ciliumegressnatpolicies -{% if cilium_version | regex_replace('v') is version('1.11', '>=') %} - - ciliumendpointslices -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.12', '>=') %} - - ciliumbgploadbalancerippools - - ciliumbgppeeringpolicies -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.11.5', '<') %} - - ciliumnetworkpolicies/finalizers - - ciliumclusterwidenetworkpolicies/finalizers - - ciliumendpoints/finalizers - - ciliumnodes/finalizers - - ciliumidentities/finalizers - - ciliumlocalredirectpolicies/finalizers -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.14', '>=') %} - - ciliuml2announcementpolicies/status -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.15', '>=') %} - - ciliumbgpnodeconfigs - - ciliumbgpnodeconfigs/status - - ciliumbgpadvertisements - - ciliumbgppeerconfigs -{% endif %} - verbs: - - '*' -{% if cilium_version | regex_replace('v') is version('1.12', '>=') %} -- apiGroups: - - cilium.io - resources: - - ciliumclusterwideenvoyconfigs - - ciliumenvoyconfigs - - ciliumegressgatewaypolicies - verbs: - - list - - watch -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.14', '>=') %} -- apiGroups: - - cilium.io - resources: - - ciliumcidrgroups - - ciliuml2announcementpolicies - - ciliumpodippools - - ciliuml2announcementpolicies/status - verbs: - - list - - watch -{% if cilium_version %} -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - get - - update - - list - - delete -{% endif %} -{% endif %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/crb.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/crb.yml.j2 deleted file mode 100644 index d23897f..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium/crb.yml.j2 +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium -subjects: -- kind: ServiceAccount - name: cilium - namespace: kube-system diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/ds.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/ds.yml.j2 deleted file mode 100644 index 658f53b..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium/ds.yml.j2 +++ /dev/null @@ -1,446 +0,0 @@ ---- -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: cilium - namespace: kube-system - labels: - k8s-app: cilium -spec: - selector: - matchLabels: - k8s-app: cilium - updateStrategy: - rollingUpdate: - # Specifies the maximum number of Pods that can be unavailable during the update process. - maxUnavailable: 2 - type: RollingUpdate - template: - metadata: - annotations: -{% if cilium_enable_prometheus %} - prometheus.io/port: "{{ cilium_agent_scrape_port }}" - prometheus.io/scrape: "true" -{% endif %} - scheduler.alpha.kubernetes.io/tolerations: '[{"key":"dedicated","operator":"Equal","value":"master","effect":"NoSchedule"}]' - labels: - k8s-app: cilium - spec: - containers: - - name: cilium-agent - image: "{{ cilium_image_repo }}:{{ cilium_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - cilium-agent - args: - - --config-dir=/tmp/cilium/config-map -{% if cilium_mtu != "" %} - - --mtu={{ cilium_mtu }} -{% endif %} -{% if cilium_agent_custom_args is string %} - - {{ cilium_agent_custom_args }} -{% else %} -{% for flag in cilium_agent_custom_args %} - - {{ flag }} -{% endfor %} -{% endif %} - startupProbe: - httpGet: - host: '127.0.0.1' - path: /healthz - port: {{ cilium_agent_health_port }} - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - failureThreshold: 105 - periodSeconds: 2 - successThreshold: 1 - livenessProbe: - httpGet: - host: '127.0.0.1' - path: /healthz - port: {{ cilium_agent_health_port }} - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - failureThreshold: 10 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 5 - readinessProbe: - httpGet: - host: 127.0.0.1 - path: /healthz - port: {{ cilium_agent_health_port }} - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - initialDelaySeconds: 5 - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 5 - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: CILIUM_CLUSTERMESH_CONFIG - value: /var/lib/cilium/clustermesh/ -{% if cilium_kube_proxy_replacement == 'strict' %} - - name: KUBERNETES_SERVICE_HOST - value: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}" - - name: KUBERNETES_SERVICE_PORT - value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}" -{% endif %} -{% for env_var in cilium_agent_extra_env_vars %} - - {{ env_var | to_nice_yaml(indent=2) | indent(10) }} -{% endfor %} - lifecycle: -{% if cilium_version | regex_replace('v') is version('1.14', '<') %} - postStart: - exec: - command: - - "/cni-install.sh" - - "--cni-exclusive={{ cilium_cni_exclusive | string | lower }}" -{% if cilium_version | regex_replace('v') is version('1.12', '>=') %} - - "--enable-debug={{ cilium_debug | string | lower }}" - - "--log-file={{ cilium_cni_log_file }}" -{% endif %} -{% endif %} - preStop: - exec: - command: - - /cni-uninstall.sh - resources: - limits: - cpu: {{ cilium_cpu_limit }} - memory: {{ cilium_memory_limit }} - requests: - cpu: {{ cilium_cpu_requests }} - memory: {{ cilium_memory_requests }} -{% if cilium_enable_prometheus or cilium_enable_hubble_metrics %} - ports: -{% endif %} -{% if cilium_enable_prometheus %} - - name: prometheus - containerPort: {{ cilium_agent_scrape_port }} - hostPort: {{ cilium_agent_scrape_port }} - protocol: TCP -{% endif %} -{% if cilium_enable_hubble_metrics %} - - name: hubble-metrics - containerPort: {{ cilium_hubble_scrape_port }} - hostPort: {{ cilium_hubble_scrape_port }} - protocol: TCP -{% endif %} - securityContext: - privileged: true - volumeMounts: - - name: bpf-maps - mountPath: /sys/fs/bpf - mountPropagation: Bidirectional - - name: cilium-run - mountPath: /var/run/cilium -{% if cilium_version | regex_replace('v') is version('1.13.1', '<') %} - - name: cni-path - mountPath: /host/opt/cni/bin -{% endif %} - - name: etc-cni-netd - mountPath: /host/etc/cni/net.d -{% if cilium_identity_allocation_mode == "kvstore" %} - - name: etcd-config-path - mountPath: /var/lib/etcd-config - readOnly: true - - name: etcd-secrets - mountPath: "{{ cilium_cert_dir }}" - readOnly: true -{% endif %} - - name: clustermesh-secrets - mountPath: /var/lib/cilium/clustermesh - readOnly: true - - name: cilium-config-path - mountPath: /tmp/cilium/config-map - readOnly: true -{% if cilium_ip_masq_agent_enable %} - - name: ip-masq-agent - mountPath: /etc/config - readOnly: true -{% endif %} - # Needed to be able to load kernel modules - - name: lib-modules - mountPath: /lib/modules - readOnly: true - - name: xtables-lock - mountPath: /run/xtables.lock -{% if cilium_encryption_enabled and cilium_encryption_type == "ipsec" %} - - name: cilium-ipsec-secrets - mountPath: /etc/ipsec - readOnly: true -{% endif %} -{% if cilium_hubble_install %} - - name: hubble-tls - mountPath: /var/lib/cilium/tls/hubble - readOnly: true -{% endif %} -{% for volume_mount in cilium_agent_extra_volume_mounts %} - - {{ volume_mount | to_nice_yaml(indent=2) | indent(10) }} -{% endfor %} -# In managed etcd mode, Cilium must be able to resolve the DNS name of the etcd service -{% if cilium_identity_allocation_mode == "kvstore" %} - dnsPolicy: ClusterFirstWithHostNet -{% endif %} - hostNetwork: true - initContainers: -{% if cilium_version | regex_replace('v') is version('1.11', '>=') and cilium_cgroup_auto_mount %} - - name: mount-cgroup - image: "{{ cilium_image_repo }}:{{ cilium_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - env: - - name: CGROUP_ROOT - value: {{ cilium_cgroup_host_root }} - - name: BIN_PATH - value: /opt/cni/bin - command: - - sh - - -ec - # The statically linked Go program binary is invoked to avoid any - # dependency on utilities like sh and mount that can be missing on certain - # distros installed on the underlying host. Copy the binary to the - # same directory where we install cilium cni plugin so that exec permissions - # are available. - - | - cp /usr/bin/cilium-mount /hostbin/cilium-mount; - nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT; - rm /hostbin/cilium-mount - volumeMounts: - - name: hostproc - mountPath: /hostproc - - name: cni-path - mountPath: /hostbin - securityContext: - privileged: true -{% endif %} -{% if cilium_version | regex_replace('v') is version('1.11.7', '>=') %} - - name: apply-sysctl-overwrites - image: "{{ cilium_image_repo }}:{{ cilium_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - env: - - name: BIN_PATH - value: /opt/cni/bin - command: - - sh - - -ec - # The statically linked Go program binary is invoked to avoid any - # dependency on utilities like sh that can be missing on certain - # distros installed on the underlying host. Copy the binary to the - # same directory where we install cilium cni plugin so that exec permissions - # are available. - - | - cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix; - nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix"; - rm /hostbin/cilium-sysctlfix - volumeMounts: - - name: hostproc - mountPath: /hostproc - - name: cni-path - mountPath: /hostbin - securityContext: - privileged: true -{% endif %} - - name: clean-cilium-state - image: "{{ cilium_image_repo }}:{{ cilium_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - /init-container.sh - env: - - name: CILIUM_ALL_STATE - valueFrom: - configMapKeyRef: - name: cilium-config - key: clean-cilium-state - optional: true - - name: CILIUM_BPF_STATE - valueFrom: - configMapKeyRef: - name: cilium-config - key: clean-cilium-bpf-state - optional: true -# Removed in 1.11 and up. -# https://github.com/cilium/cilium/commit/f7a3f59fd74983c600bfce9cac364b76d20849d9 -{% if cilium_version | regex_replace('v') is version('1.11', '<') %} - - name: CILIUM_WAIT_BPF_MOUNT - valueFrom: - configMapKeyRef: - key: wait-bpf-mount - name: cilium-config - optional: true -{% endif %} -{% if cilium_kube_proxy_replacement == 'strict' %} - - name: KUBERNETES_SERVICE_HOST - value: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}" - - name: KUBERNETES_SERVICE_PORT - value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}" -{% endif %} - securityContext: - privileged: true - volumeMounts: - - name: bpf-maps - mountPath: /sys/fs/bpf -{% if cilium_version | regex_replace('v') is version('1.11', '>=') %} - # Required to mount cgroup filesystem from the host to cilium agent pod - - name: cilium-cgroup - mountPath: {{ cilium_cgroup_host_root }} - mountPropagation: HostToContainer -{% endif %} - - name: cilium-run - mountPath: /var/run/cilium - resources: - requests: - cpu: 100m - memory: 100Mi -{% if cilium_version | regex_replace('v') is version('1.13.1', '>=') %} - # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent - - name: install-cni-binaries - image: "{{ cilium_image_repo }}:{{ cilium_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - "/install-plugin.sh" - resources: - requests: - cpu: 100m - memory: 10Mi - securityContext: - privileged: true - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: cni-path - mountPath: /host/opt/cni/bin -{% endif %} - restartPolicy: Always - priorityClassName: system-node-critical - serviceAccount: cilium - serviceAccountName: cilium - terminationGracePeriodSeconds: 1 - hostNetwork: true -# In managed etcd mode, Cilium must be able to resolve the DNS name of the etcd service -{% if cilium_identity_allocation_mode == "kvstore" %} - dnsPolicy: ClusterFirstWithHostNet -{% endif %} - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - topologyKey: kubernetes.io/hostname - labelSelector: - matchLabels: - k8s-app: cilium - tolerations: - - operator: Exists - volumes: - # To keep state between restarts / upgrades - - name: cilium-run - hostPath: - path: /var/run/cilium - type: DirectoryOrCreate - # To keep state between restarts / upgrades for bpf maps - - name: bpf-maps - hostPath: - path: /sys/fs/bpf - type: DirectoryOrCreate -{% if cilium_version | regex_replace('v') is version('1.11', '>=') %} - # To mount cgroup2 filesystem on the host - - name: hostproc - hostPath: - path: /proc - type: Directory - # To keep state between restarts / upgrades for cgroup2 filesystem - - name: cilium-cgroup - hostPath: - path: {{ cilium_cgroup_host_root }} - type: DirectoryOrCreate -{% endif %} - # To install cilium cni plugin in the host - - name: cni-path - hostPath: - path: /opt/cni/bin - type: DirectoryOrCreate - # To install cilium cni configuration in the host - - name: etc-cni-netd - hostPath: - path: /etc/cni/net.d - type: DirectoryOrCreate - # To be able to load kernel modules - - name: lib-modules - hostPath: - path: /lib/modules - # To access iptables concurrently with other processes (e.g. kube-proxy) - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate -{% if cilium_identity_allocation_mode == "kvstore" %} - # To read the etcd config stored in config maps - - name: etcd-config-path - configMap: - name: cilium-config - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - items: - - key: etcd-config - path: etcd.config - # To read the k8s etcd secrets in case the user might want to use TLS - - name: etcd-secrets - hostPath: - path: "{{ cilium_cert_dir }}" -{% endif %} - # To read the clustermesh configuration - - name: clustermesh-secrets - secret: - secretName: cilium-clustermesh - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - optional: true - # To read the configuration from the config map - - name: cilium-config-path - configMap: - name: cilium-config -{% if cilium_ip_masq_agent_enable %} - - name: ip-masq-agent - configMap: - name: ip-masq-agent - optional: true - items: - - key: config - path: ip-masq-agent -{% endif %} -{% if cilium_encryption_enabled and cilium_encryption_type == "ipsec" %} - - name: cilium-ipsec-secrets - secret: - secretName: cilium-ipsec-keys -{% endif %} -{% if cilium_hubble_install %} - - name: hubble-tls - projected: - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - sources: - - secret: - name: hubble-server-certs - optional: true - items: - - key: ca.crt - path: client-ca.crt - - key: tls.crt - path: server.crt - - key: tls.key - path: server.key -{% endif %} diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/sa.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/sa.yml.j2 deleted file mode 100644 index c03ac59..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium/sa.yml.j2 +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cilium - namespace: kube-system diff --git a/kubespray/project/roles/network_plugin/cilium/templates/cilium/secret.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/cilium/secret.yml.j2 deleted file mode 100644 index 776c689..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/cilium/secret.yml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: v1 -data: - keys: {{ cilium_ipsec_key }} -kind: Secret -metadata: - name: cilium-ipsec-keys - namespace: kube-system -type: Opaque diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/config.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/config.yml.j2 deleted file mode 100644 index f3af717..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/config.yml.j2 +++ /dev/null @@ -1,71 +0,0 @@ -#jinja2: trim_blocks:False ---- -# Source: cilium helm chart: cilium/templates/hubble-relay/configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: hubble-relay-config - namespace: kube-system -data: - config.yaml: | - cluster-name: "{{ cilium_cluster_name }}" - peer-service: "hubble-peer.kube-system.svc.{{ dns_domain }}:443" - listen-address: :4245 - metrics-listen-address: ":9966" - dial-timeout: - retry-timeout: - sort-buffer-len-max: - sort-buffer-drain-timeout: - tls-client-cert-file: /var/lib/hubble-relay/tls/client.crt - tls-client-key-file: /var/lib/hubble-relay/tls/client.key - tls-server-cert-file: /var/lib/hubble-relay/tls/server.crt - tls-server-key-file: /var/lib/hubble-relay/tls/server.key - tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt - disable-server-tls: {% if cilium_hubble_tls_generate %}false{% else %}true{% endif %} - disable-client-tls: {% if cilium_hubble_tls_generate %}false{% else %}true{% endif %} ---- -# Source: cilium/templates/hubble-ui/configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: hubble-ui-nginx - namespace: kube-system -data: - nginx.conf: | - server { - listen 8081; - {% if cilium_enable_ipv6 %} - listen [::]:8081; - {% endif %} - server_name localhost; - root /app; - index index.html; - client_max_body_size 1G; - - location / { - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - - # CORS - add_header Access-Control-Allow-Methods "GET, POST, PUT, HEAD, DELETE, OPTIONS"; - add_header Access-Control-Allow-Origin *; - add_header Access-Control-Max-Age 1728000; - add_header Access-Control-Expose-Headers content-length,grpc-status,grpc-message; - add_header Access-Control-Allow-Headers range,keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout; - if ($request_method = OPTIONS) { - return 204; - } - # /CORS - - location /api { - proxy_http_version 1.1; - proxy_pass_request_headers on; - proxy_hide_header Access-Control-Allow-Origin; - proxy_pass http://127.0.0.1:8090; - } - - location / { - try_files $uri $uri/ /index.html; - } - } - } diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/cr.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/cr.yml.j2 deleted file mode 100644 index 4a95565..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/cr.yml.j2 +++ /dev/null @@ -1,106 +0,0 @@ -{% if cilium_hubble_tls_generate %} ---- -# Source: cilium/templates/hubble-generate-certs-clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: hubble-generate-certs -rules: - - apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - create - - apiGroups: - - "" - resources: - - secrets - resourceNames: - - hubble-server-certs - - hubble-relay-client-certs - - hubble-relay-server-certs - verbs: - - update - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - hubble-ca-cert - verbs: - - update - - apiGroups: - - "" - resources: - - secrets - resourceNames: - - hubble-ca-secret - verbs: - - get -{% endif %} ---- -# Source: cilium/templates/hubble-relay-clusterrole.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: hubble-relay -rules: - - apiGroups: - - "" - resources: - - componentstatuses - - endpoints - - namespaces - - nodes - - pods - - services - verbs: - - get - - list - - watch ---- -# Source: cilium/templates/hubble-ui-clusterrole.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: hubble-ui -rules: - - apiGroups: - - networking.k8s.io - resources: - - networkpolicies - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - componentstatuses - - endpoints - - namespaces - - nodes - - pods - - services - verbs: - - get - - list - - watch - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - apiGroups: - - cilium.io - resources: - - "*" - verbs: - - get - - list - - watch diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/crb.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/crb.yml.j2 deleted file mode 100644 index f033429..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/crb.yml.j2 +++ /dev/null @@ -1,44 +0,0 @@ -{% if cilium_hubble_tls_generate %} ---- -# Source: cilium/templates/hubble-generate-certs-clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: hubble-generate-certs -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: hubble-generate-certs -subjects: -- kind: ServiceAccount - name: hubble-generate-certs - namespace: kube-system -{% endif %} ---- -# Source: cilium/templates/hubble-relay-clusterrolebinding.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: hubble-relay -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: hubble-relay -subjects: -- kind: ServiceAccount - namespace: kube-system - name: hubble-relay ---- -# Source: cilium/templates/hubble-ui-clusterrolebinding.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: hubble-ui -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: hubble-ui -subjects: -- kind: ServiceAccount - namespace: kube-system - name: hubble-ui diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/cronjob.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/cronjob.yml.j2 deleted file mode 100644 index 8010c52..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/cronjob.yml.j2 +++ /dev/null @@ -1,38 +0,0 @@ ---- -# Source: cilium/templates/hubble-generate-certs-cronjob.yaml -apiVersion: batch/v1 -kind: CronJob -metadata: - name: hubble-generate-certs - namespace: kube-system - labels: - k8s-app: hubble-generate-certs -spec: - schedule: "0 0 1 */4 *" - concurrencyPolicy: Forbid - jobTemplate: - spec: - template: - metadata: - labels: - k8s-app: hubble-generate-certs - spec: - serviceAccount: hubble-generate-certs - serviceAccountName: hubble-generate-certs - containers: - - name: certgen - image: "{{ cilium_hubble_certgen_image_repo }}:{{ cilium_hubble_certgen_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - "/usr/bin/cilium-certgen" - # Because this is executed as a job, we pass the values as command - # line args instead of via config map. This allows users to inspect - # the values used in past runs by inspecting the completed pod. - args: - {% for key, value in cilium_certgen_args.items() -%} - - "--{{ key }}={{ value }}" - {% endfor %} - - hostNetwork: true - restartPolicy: OnFailure - ttlSecondsAfterFinished: 1800 diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/deploy.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/deploy.yml.j2 deleted file mode 100644 index f0153d6..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/deploy.yml.j2 +++ /dev/null @@ -1,197 +0,0 @@ ---- -# Source: cilium/templates/hubble-relay-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: hubble-relay - labels: - k8s-app: hubble-relay - namespace: kube-system -spec: - replicas: 1 - selector: - matchLabels: - k8s-app: hubble-relay - strategy: - rollingUpdate: - maxUnavailable: 1 - type: RollingUpdate - template: - metadata: - annotations: - labels: - k8s-app: hubble-relay - spec: - affinity: - podAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: "k8s-app" - operator: In - values: - - cilium - topologyKey: "kubernetes.io/hostname" - containers: - - name: hubble-relay - image: "{{ cilium_hubble_relay_image_repo }}:{{ cilium_hubble_relay_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - hubble-relay - args: - - serve - ports: - - name: grpc - containerPort: 4245 -{% if cilium_enable_prometheus %} - - name: prometheus - containerPort: 9966 - protocol: TCP -{% endif %} - readinessProbe: - tcpSocket: - port: grpc - livenessProbe: - tcpSocket: - port: grpc - volumeMounts: - - mountPath: /var/run/cilium - name: hubble-sock-dir - readOnly: true - - mountPath: /etc/hubble-relay - name: config - readOnly: true - {% if cilium_hubble_tls_generate -%} - - mountPath: /var/lib/hubble-relay/tls - name: tls - readOnly: true - {%- endif %} - - restartPolicy: Always - serviceAccount: hubble-relay - serviceAccountName: hubble-relay - terminationGracePeriodSeconds: 0 - volumes: - - configMap: - name: hubble-relay-config - items: - - key: config.yaml - path: config.yaml - name: config - - hostPath: - path: /var/run/cilium - type: Directory - name: hubble-sock-dir - {% if cilium_hubble_tls_generate -%} - - projected: - sources: - - secret: - name: hubble-relay-client-certs - items: - - key: ca.crt - path: hubble-server-ca.crt - - key: tls.crt - path: client.crt - - key: tls.key - path: client.key - - secret: - name: hubble-server-certs - items: - - key: tls.crt - path: server.crt - - key: tls.key - path: server.key - name: tls - {%- endif %} - ---- -# Source: cilium/templates/hubble-ui/deployment.yaml -kind: Deployment -apiVersion: apps/v1 -metadata: - namespace: kube-system - labels: - k8s-app: hubble-ui - name: hubble-ui -spec: - replicas: 1 - selector: - matchLabels: - k8s-app: hubble-ui - template: - metadata: - annotations: - labels: - k8s-app: hubble-ui - spec: - securityContext: - runAsUser: 1001 - serviceAccount: hubble-ui - serviceAccountName: hubble-ui - containers: - - name: frontend - image: "{{ cilium_hubble_ui_image_repo }}:{{ cilium_hubble_ui_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - ports: - - containerPort: 8081 - name: http - volumeMounts: - - name: hubble-ui-nginx-conf - mountPath: /etc/nginx/conf.d/default.conf - subPath: nginx.conf - - name: tmp-dir - mountPath: /tmp - resources: - {} - - name: backend - image: "{{ cilium_hubble_ui_backend_image_repo }}:{{ cilium_hubble_ui_backend_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - env: - - name: EVENTS_SERVER_PORT - value: "8090" - {% if cilium_hubble_tls_generate -%} - - name: TLS_TO_RELAY_ENABLED - value: "true" - - name: FLOWS_API_ADDR - value: "hubble-relay:443" - - name: TLS_RELAY_SERVER_NAME - value: ui.{{ cilium_cluster_name }}.hubble-grpc.cilium.io - - name: TLS_RELAY_CA_CERT_FILES - value: /var/lib/hubble-ui/certs/hubble-server-ca.crt - - name: TLS_RELAY_CLIENT_CERT_FILE - value: /var/lib/hubble-ui/certs/client.crt - - name: TLS_RELAY_CLIENT_KEY_FILE - value: /var/lib/hubble-ui/certs/client.key - {% else -%} - - name: FLOWS_API_ADDR - value: "hubble-relay:80" - {% endif %} - - volumeMounts: - - name: tls - mountPath: /var/lib/hubble-ui/certs - readOnly: true - ports: - - containerPort: 8090 - name: grpc - resources: - {} - volumes: - - configMap: - defaultMode: 420 - name: hubble-ui-nginx - name: hubble-ui-nginx-conf - - projected: - sources: - - secret: - name: hubble-relay-client-certs - items: - - key: ca.crt - path: hubble-server-ca.crt - - key: tls.crt - path: client.crt - - key: tls.key - path: client.key - name: tls - - emptyDir: {} - name: tmp-dir diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/job.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/job.yml.j2 deleted file mode 100644 index 9ad3ae3..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/job.yml.j2 +++ /dev/null @@ -1,34 +0,0 @@ ---- -# Source: cilium/templates/hubble-generate-certs-job.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: hubble-generate-certs - namespace: kube-system - labels: - k8s-app: hubble-generate-certs -spec: - template: - metadata: - labels: - k8s-app: hubble-generate-certs - spec: - serviceAccount: hubble-generate-certs - serviceAccountName: hubble-generate-certs - containers: - - name: certgen - image: "{{ cilium_hubble_certgen_image_repo }}:{{ cilium_hubble_certgen_image_tag }}" - imagePullPolicy: {{ k8s_image_pull_policy }} - command: - - "/usr/bin/cilium-certgen" - # Because this is executed as a job, we pass the values as command - # line args instead of via config map. This allows users to inspect - # the values used in past runs by inspecting the completed pod. - args: - {% for key, value in cilium_certgen_args.items() -%} - - "--{{ key }}={{ value }}" - {% endfor %} - - hostNetwork: true - restartPolicy: OnFailure - ttlSecondsAfterFinished: 1800 diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/sa.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/sa.yml.j2 deleted file mode 100644 index 9b3203d..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/sa.yml.j2 +++ /dev/null @@ -1,23 +0,0 @@ -{% if cilium_hubble_tls_generate %} ---- -# Source: cilium/templates/hubble-generate-certs-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: hubble-generate-certs - namespace: kube-system -{% endif %} ---- -# Source: cilium/templates/hubble-relay-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: hubble-relay - namespace: kube-system ---- -# Source: cilium/templates/hubble-ui-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: hubble-ui - namespace: kube-system diff --git a/kubespray/project/roles/network_plugin/cilium/templates/hubble/service.yml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/hubble/service.yml.j2 deleted file mode 100644 index 48e90b8..0000000 --- a/kubespray/project/roles/network_plugin/cilium/templates/hubble/service.yml.j2 +++ /dev/null @@ -1,104 +0,0 @@ -{% if cilium_enable_prometheus or cilium_enable_hubble_metrics %} ---- -# Source: cilium/templates/cilium-agent-service.yaml -kind: Service -apiVersion: v1 -metadata: - name: hubble-metrics - namespace: kube-system - annotations: - prometheus.io/scrape: 'true' - prometheus.io/port: "{{ cilium_hubble_scrape_port }}" - labels: - k8s-app: hubble -spec: - clusterIP: None - type: ClusterIP - ports: - - name: hubble-metrics - port: 9091 - protocol: TCP - targetPort: hubble-metrics - selector: - k8s-app: cilium ---- -# Source: cilium/templates/hubble-relay/metrics-service.yaml -# We use a separate service from hubble-relay which can be exposed externally -kind: Service -apiVersion: v1 -metadata: - name: hubble-relay-metrics - namespace: kube-system - labels: - k8s-app: hubble-relay - annotations: - prometheus.io/scrape: 'true' - prometheus.io/port: "9966" -spec: - clusterIP: None - type: ClusterIP - selector: - k8s-app: hubble-relay - ports: - - name: metrics - port: 9966 - protocol: TCP - targetPort: prometheus - -{% endif %} ---- -# Source: cilium/templates/hubble-relay-service.yaml -kind: Service -apiVersion: v1 -metadata: - name: hubble-relay - namespace: kube-system - labels: - k8s-app: hubble-relay -spec: - type: ClusterIP - selector: - k8s-app: hubble-relay - ports: - - protocol: TCP - {% if cilium_hubble_tls_generate -%} - port: 443 - {% else -%} - port: 80 - {% endif -%} - targetPort: 4245 ---- -# Source: cilium/templates/hubble-ui-service.yaml -kind: Service -apiVersion: v1 -metadata: - name: hubble-ui - labels: - k8s-app: hubble-ui - namespace: kube-system -spec: - selector: - k8s-app: hubble-ui - ports: - - name: http - port: 80 - targetPort: 8081 - type: ClusterIP ---- -# Source: cilium/templates/hubble/peer-service.yaml -apiVersion: v1 -kind: Service -metadata: - name: hubble-peer - namespace: kube-system - labels: - k8s-app: cilium -spec: - selector: - k8s-app: cilium - ports: - - name: peer-service - port: 443 - protocol: TCP - targetPort: 4244 - internalTrafficPolicy: Local diff --git a/kubespray/project/roles/network_plugin/cilium/templates/values.yaml.j2 b/kubespray/project/roles/network_plugin/cilium/templates/values.yaml.j2 new file mode 100644 index 0000000..5aa2a22 --- /dev/null +++ b/kubespray/project/roles/network_plugin/cilium/templates/values.yaml.j2 @@ -0,0 +1,164 @@ +MTU: {{ cilium_mtu }} +debug: + enabled: {{ cilium_debug }} + +image: + repository: {{ cilium_image_repo }} + tag: {{ cilium_image_tag }} + +k8sServiceHost: "auto" +k8sServicePort: "auto" + +ipv4: + enabled: {{ cilium_enable_ipv4 }} +ipv6: + enabled: {{ cilium_enable_ipv6 }} + +l2announcements: + enabled: {{ cilium_l2announcements }} + +healthPort: {{ cilium_agent_health_port }} + +identityAllocationMode: {{ cilium_identity_allocation_mode }} + +tunnelProtocol: {{ cilium_tunnel_mode }} + +loadbalancer: + mode: {{ cilium_loadbalancer_mode }} + +kubeProxyReplacement: {{ cilium_kube_proxy_replacement }} + +{% if cilium_dns_proxy_enable_transparent_mode is defined %} +dnsProxy: + enableTransparentMode: {{ cilium_dns_proxy_enable_transparent_mode }} +{% endif %} + +extraVolumes: + {{ cilium_agent_extra_volumes | to_nice_yaml(indent=2) | indent(2) }} + +extraVolumeMounts: + {{ cilium_agent_extra_volume_mounts | to_nice_yaml(indent=2) | indent(2) }} + +extraArgs: + {{ cilium_agent_extra_args | to_nice_yaml(indent=2) | indent(2) }} + +bpf: + masquerade: {{ cilium_enable_bpf_masquerade }} + hostLegacyRouting: {{ cilium_enable_host_legacy_routing }} + monitorAggregation: {{ cilium_monitor_aggregation }} + preallocateMaps: {{ cilium_preallocate_bpf_maps }} + mapDynamicSizeRatio: {{ cilium_bpf_map_dynamic_size_ratio }} + +cni: + exclusive: {{ cilium_cni_exclusive }} + logFile: {{ cilium_cni_log_file }} + +autoDirectNodeRoutes: {{ cilium_auto_direct_node_routes }} + +ipv4NativeRoutingCIDR: {{ cilium_native_routing_cidr }} +ipv6NativeRoutingCIDR: {{ cilium_native_routing_cidr_ipv6 }} + +encryption: + enabled: {{ cilium_encryption_enabled }} + {% if cilium_encryption_enabled %} + type: {{ cilium_encryption_type }} + {% if cilium_encryption_type == 'wireguard' %} + nodeEncryption: {{ cilium_encryption_node_encryption }} + {% endif %} + + {% endif %} + +bandwidthManager: + enabled: {{ cilium_enable_bandwidth_manager }} + bbr: {{ cilium_enable_bandwidth_manager_bbr }} + +ipMasqAgent: + enabled: {{ cilium_ip_masq_agent_enable }} + {% if cilium_ip_masq_agent_enable %} + config: + nonMasqueradeCIDRs: {{ cilium_non_masquerade_cidrs }} + masqLinkLocal: {{ cilium_masq_link_local }} + masqLinkLocalIPv6: {{ cilium_masq_link_local_ipv6 }} + # cilium_ip_masq_resync_interval + {% endif %} + +hubble: + enabled: {{ cilium_enable_hubble }} + relay: + enabled: {{ cilium_enable_hubble }} + image: + repository: {{ cilium_hubble_relay_image_repo }} + tag: {{ cilium_hubble_relay_image_tag }} + ui: + enabled: {{ cilium_enable_hubble_ui }} + backend: + image: + repository: {{ cilium_hubble_ui_backend_image_repo }} + tag: {{ cilium_hubble_ui_backend_image_tag }} + frontend: + image: + repository: {{ cilium_hubble_ui_image_repo }} + tag: {{ cilium_hubble_ui_image_tag }} + metrics: + enabled: {{ cilium_hubble_metrics }} + export: + fileMaxBackups: {{ cilium_hubble_export_file_max_backups }} + fileMaxSizeMb: {{ cilium_hubble_export_file_max_size_mb }} + dynamic: + enabled: {{ cilium_hubble_export_dynamic_enabled }} + config: + content: + {{ cilium_hubble_export_dynamic_config_content | to_nice_yaml(indent=10) | indent(10) }} + +gatewayAPI: + enabled: {{ cilium_gateway_api_enabled }} + +ipam: + mode: {{ cilium_ipam_mode }} + operator: + clusterPoolIPv4PodCIDRList: + - {{ cilium_pool_cidr | default(kube_pods_subnet) }} + clusterPoolIPv4MaskSize: {{ cilium_pool_mask_size | default(kube_network_node_prefix) }} + + clusterPoolIPv6PodCIDRList: + - {{ cilium_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6) }} + clusterPoolIPv6MaskSize: {{ cilium_pool_mask_size_ipv6 | default(kube_network_node_prefix_ipv6) }} + +cgroup: + autoMount: + enabled: {{ cilium_cgroup_auto_mount }} + hostRoot: {{ cilium_cgroup_host_root }} + +operator: + image: + repository: {{ cilium_operator_image_repo }} + tag: {{ cilium_operator_image_tag }} + replicas: {{ cilium_operator_replicas }} + extraArgs: + {{ cilium_operator_extra_args | to_nice_yaml(indent=2) | indent(4) }} + extraVolumes: + {{ cilium_operator_extra_volumes | to_nice_yaml(indent=2) | indent(4) }} + extraVolumeMounts: + {{ cilium_operator_extra_volume_mounts | to_nice_yaml(indent=2) | indent(4) }} + tolerations: + {{ cilium_operator_tolerations | to_nice_yaml(indent=2) | indent(4) }} + +cluster: + id: {{ cilium_cluster_id }} + name: {{ cilium_cluster_name }} + +enableIPv4Masquerade: {{ cilium_enable_ipv4_masquerade }} +enableIPv6Masquerade: {{ cilium_enable_ipv6_masquerade }} + +hostFirewall: + enabled: {{ cilium_enable_host_firewall }} + +certgen: + image: + repositry: {{ cilium_hubble_certgen_image_repo }} + tag: {{ cilium_hubble_certgen_image_tag }} + +envoy: + image: + repositry: {{ cilium_hubble_envoy_image_repo }} + tag: {{ cilium_hubble_envoy_image_tag }} diff --git a/kubespray/project/roles/network_plugin/flannel/defaults/main.yml b/kubespray/project/roles/network_plugin/flannel/defaults/main.yml index 8d7713b..16ada70 100644 --- a/kubespray/project/roles/network_plugin/flannel/defaults/main.yml +++ b/kubespray/project/roles/network_plugin/flannel/defaults/main.yml @@ -2,7 +2,7 @@ # Flannel public IP # The address that flannel should advertise as how to access the system # Disabled until https://github.com/coreos/flannel/issues/712 is fixed -# flannel_public_ip: "{{ access_ip | default(ip | default(fallback_ips[inventory_hostname])) }}" +# flannel_public_ip: "{{ main_access_ip }}" ## interface that should be used for flannel operations ## This is actually an inventory cluster-level item diff --git a/kubespray/project/roles/network_plugin/flannel/templates/cni-flannel.yml.j2 b/kubespray/project/roles/network_plugin/flannel/templates/cni-flannel.yml.j2 index 9c36d01..da4cfcd 100644 --- a/kubespray/project/roles/network_plugin/flannel/templates/cni-flannel.yml.j2 +++ b/kubespray/project/roles/network_plugin/flannel/templates/cni-flannel.yml.j2 @@ -30,12 +30,14 @@ data: } net-conf.json: | { +{% if ipv4_stack %} "Network": "{{ kube_pods_subnet }}", "EnableIPv4": true, -{% if enable_dual_stack_networks %} +{% endif %} +{% if ipv6_stack %} "EnableIPv6": true, "IPv6Network": "{{ kube_pods_subnet_ipv6 }}", -{% endif %} +{% endif %} "Backend": { "Type": "{{ flannel_backend_type }}"{% if flannel_backend_type == "vxlan" %}, "VNI": {{ flannel_vxlan_vni }}, diff --git a/kubespray/project/roles/network_plugin/kube-ovn/OWNERS b/kubespray/project/roles/network_plugin/kube-ovn/OWNERS deleted file mode 100644 index 84256aa..0000000 --- a/kubespray/project/roles/network_plugin/kube-ovn/OWNERS +++ /dev/null @@ -1,4 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -emeritus_approvers: -- oilbeater diff --git a/kubespray/project/roles/network_plugin/kube-ovn/defaults/main.yml b/kubespray/project/roles/network_plugin/kube-ovn/defaults/main.yml index 8b96207..4262a77 100644 --- a/kubespray/project/roles/network_plugin/kube-ovn/defaults/main.yml +++ b/kubespray/project/roles/network_plugin/kube-ovn/defaults/main.yml @@ -33,7 +33,7 @@ kube_ovn_central_replics: "{{ kube_ovn_central_hosts | length }}" kube_ovn_controller_replics: "{{ kube_ovn_central_hosts | length }}" kube_ovn_central_ips: |- {% for item in kube_ovn_central_hosts -%} - {{ hostvars[item]['ip'] | default(fallback_ips[item]) }}{% if not loop.last %},{% endif %} + {{ hostvars[item]['main_ip'] }}{% if not loop.last %},{% endif %} {%- endfor %} kube_ovn_ic_enable: false @@ -62,6 +62,15 @@ kube_ovn_traffic_mirror: false kube_ovn_external_address: 8.8.8.8 kube_ovn_external_address_ipv6: 2400:3200::1 +kube_ovn_external_address_merged: >- + {%- if ipv4_stack and ipv6_stack -%} + {{ kube_ovn_external_address }},{{ kube_ovn_external_address_ipv6 }} + {%- elif ipv4_stack -%} + {{ kube_ovn_external_address }} + {%- else -%} + {{ kube_ovn_external_address_ipv6 }} + {%- endif -%} + kube_ovn_external_dns: alauda.cn # kube_ovn_default_gateway: 10.233.64.1,fd85:ee78:d8a6:8607::1:0 @@ -74,6 +83,14 @@ kube_ovn_u2o_interconnection: false # kube_ovn_default_exclude_ips: 10.16.0.1 kube_ovn_node_switch_cidr: 100.64.0.0/16 kube_ovn_node_switch_cidr_ipv6: fd00:100:64::/64 +kube_ovn_node_switch_cidr_merged: >- + {%- if ipv4_stack and ipv6_stack -%} + {{ kube_ovn_node_switch_cidr }},{{ kube_ovn_node_switch_cidr_ipv6 }} + {%- elif ipv4_stack -%} + {{ kube_ovn_node_switch_cidr }} + {%- else -%} + {{ kube_ovn_node_switch_cidr_ipv6 }} + {%- endif -%} ## vlan config, set default interface name and vlan id # kube_ovn_default_interface_name: eth0 diff --git a/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-kube-ovn.yml.j2 b/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-kube-ovn.yml.j2 index f4acded..b0fad2f 100644 --- a/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-kube-ovn.yml.j2 +++ b/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-kube-ovn.yml.j2 @@ -240,14 +240,14 @@ spec: imagePullPolicy: {{ k8s_image_pull_policy }} args: - /kube-ovn/start-controller.sh - - --default-cidr={{ kube_pods_subnet }}{% if enable_dual_stack_networks %},{{ kube_ovn_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6) }}{% endif %}{{ '' }} + - --default-cidr={{ kube_pods_subnets }} - --default-gateway={% if kube_ovn_default_gateway is defined %}{{ kube_ovn_default_gateway }}{% endif %}{{ '' }} - --default-gateway-check={{ kube_ovn_default_gateway_check | string }} - --default-logical-gateway={{ kube_ovn_default_logical_gateway | string }} - --default-u2o-interconnection={{ kube_ovn_u2o_interconnection }} - --default-exclude-ips={% if kube_ovn_default_exclude_ips is defined %}{{ kube_ovn_default_exclude_ips }}{% endif %}{{ '' }} - - --node-switch-cidr={{ kube_ovn_node_switch_cidr }}{% if enable_dual_stack_networks %},{{ kube_ovn_node_switch_cidr_ipv6 }}{% endif %}{{ '' }} - - --service-cluster-ip-range={{ kube_service_addresses }}{% if enable_dual_stack_networks %},{{ kube_service_addresses_ipv6 }}{% endif %}{{ '' }} + - --node-switch-cidr={{ kube_ovn_node_switch_cidr_merged }} + - --service-cluster-ip-range={{ kube_service_subnets }} - --network-type={{ kube_ovn_network_type }} - --default-interface-name={{ kube_ovn_default_interface_name | default('') }} - --default-vlan-id={{ kube_ovn_default_vlan_id }} @@ -403,7 +403,7 @@ spec: args: - --enable-mirror={{ kube_ovn_traffic_mirror | lower }} - --encap-checksum={{ kube_ovn_encap_checksum | lower }} - - --service-cluster-ip-range={{ kube_service_addresses }}{% if enable_dual_stack_networks %},{{ kube_service_addresses_ipv6 }}{% endif %}{{ '' }} + - --service-cluster-ip-range={{ kube_service_subnets }} - --iface={{ kube_ovn_iface | default('') }} - --dpdk-tunnel-iface={{ kube_ovn_dpdk_tunnel_iface }} - --network-type={{ kube_ovn_network_type }} @@ -588,7 +588,7 @@ spec: command: - /kube-ovn/kube-ovn-pinger args: - - --external-address={{ kube_ovn_external_address }}{% if enable_dual_stack_networks %},{{ kube_ovn_external_address_ipv6 }}{% endif %}{{ '' }} + - --external-address={{ kube_ovn_external_address_merged }} - --external-dns={{ kube_ovn_external_dns }} - --logtostderr=false - --alsologtostderr=true @@ -837,7 +837,7 @@ spec: - name: metrics port: 10661 type: ClusterIP -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: @@ -852,7 +852,7 @@ metadata: labels: app: kube-ovn-pinger spec: -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: @@ -869,7 +869,7 @@ metadata: labels: app: kube-ovn-controller spec: -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: @@ -886,7 +886,7 @@ metadata: labels: app: kube-ovn-cni spec: -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: diff --git a/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2 b/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2 index 453ac60..09f0b29 100644 --- a/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2 +++ b/kubespray/project/roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2 @@ -260,7 +260,7 @@ spec: port: 6641 targetPort: 6641 type: ClusterIP -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: @@ -280,7 +280,7 @@ spec: port: 6642 targetPort: 6642 type: ClusterIP -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: @@ -300,7 +300,7 @@ spec: port: 6643 targetPort: 6643 type: ClusterIP -{% if enable_dual_stack_networks %} +{% if ipv6_stack %} ipFamilyPolicy: PreferDualStack {% endif %} selector: diff --git a/kubespray/project/roles/network_plugin/kube-router/OWNERS b/kubespray/project/roles/network_plugin/kube-router/OWNERS deleted file mode 100644 index c40af3c..0000000 --- a/kubespray/project/roles/network_plugin/kube-router/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - bozzo -reviewers: - - bozzo diff --git a/kubespray/project/roles/network_plugin/kube-router/tasks/annotate.yml b/kubespray/project/roles/network_plugin/kube-router/tasks/annotate.yml index 67d57a2..9cb7f6e 100644 --- a/kubespray/project/roles/network_plugin/kube-router/tasks/annotate.yml +++ b/kubespray/project/roles/network_plugin/kube-router/tasks/annotate.yml @@ -4,18 +4,18 @@ with_items: - "{{ kube_router_annotations_master }}" delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: kube_router_annotations_master is defined and inventory_hostname in groups['kube_control_plane'] + when: kube_router_annotations_master is defined and 'kube_control_plane' in group_names - name: Kube-router | Add annotations on kube_node command: "{{ kubectl }} annotate --overwrite node {{ ansible_hostname }} {{ item }}" with_items: - "{{ kube_router_annotations_node }}" delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: kube_router_annotations_node is defined and inventory_hostname in groups['kube_node'] + when: kube_router_annotations_node is defined and 'kube_node' in group_names - name: Kube-router | Add common annotations on all servers command: "{{ kubectl }} annotate --overwrite node {{ ansible_hostname }} {{ item }}" with_items: - "{{ kube_router_annotations_all }}" delegate_to: "{{ groups['kube_control_plane'][0] }}" - when: kube_router_annotations_all is defined and inventory_hostname in groups['k8s_cluster'] + when: kube_router_annotations_all is defined and 'k8s_cluster' in group_names diff --git a/kubespray/project/roles/network_plugin/kube-router/templates/kubeconfig.yml.j2 b/kubespray/project/roles/network_plugin/kube-router/templates/kubeconfig.yml.j2 index 42fd317..4708851 100644 --- a/kubespray/project/roles/network_plugin/kube-router/templates/kubeconfig.yml.j2 +++ b/kubespray/project/roles/network_plugin/kube-router/templates/kubeconfig.yml.j2 @@ -1,6 +1,6 @@ apiVersion: v1 kind: Config -clusterCIDR: {{ kube_pods_subnet }} +clusterCIDR: {{ kube_pods_subnets }} clusters: - name: cluster cluster: diff --git a/kubespray/project/roles/network_plugin/macvlan/OWNERS b/kubespray/project/roles/network_plugin/macvlan/OWNERS deleted file mode 100644 index c5dfbc7..0000000 --- a/kubespray/project/roles/network_plugin/macvlan/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - simon -reviewers: - - simon diff --git a/kubespray/project/roles/network_plugin/meta/main.yml b/kubespray/project/roles/network_plugin/meta/main.yml index dd2c362..e60c11c 100644 --- a/kubespray/project/roles/network_plugin/meta/main.yml +++ b/kubespray/project/roles/network_plugin/meta/main.yml @@ -1,9 +1,10 @@ --- dependencies: - role: network_plugin/cni + when: kube_network_plugin != 'none' - role: network_plugin/cilium - when: kube_network_plugin == 'cilium' or cilium_deploy_additionally | default(false) | bool + when: kube_network_plugin == 'cilium' or cilium_deploy_additionally tags: - cilium diff --git a/kubespray/project/roles/network_plugin/multus/defaults/main.yml b/kubespray/project/roles/network_plugin/multus/defaults/main.yml index c6b7ecd..a982ba6 100644 --- a/kubespray/project/roles/network_plugin/multus/defaults/main.yml +++ b/kubespray/project/roles/network_plugin/multus/defaults/main.yml @@ -6,5 +6,5 @@ multus_cni_run_dir_host: "/run" multus_cni_conf_dir: "{{ ('/host', multus_cni_conf_dir_host) | join }}" multus_cni_bin_dir: "{{ ('/host', multus_cni_bin_dir_host) | join }}" multus_cni_run_dir: "{{ ('/host', multus_cni_run_dir_host) | join }}" -multus_cni_version: "0.4.0" multus_kubeconfig_file_host: "{{ (multus_cni_conf_dir_host, '/multus.d/multus.kubeconfig') | join }}" +multus_namespace_isolation: false diff --git a/kubespray/project/roles/network_plugin/multus/templates/multus-daemonset.yml.j2 b/kubespray/project/roles/network_plugin/multus/templates/multus-daemonset.yml.j2 index 10c42c1..43d1193 100644 --- a/kubespray/project/roles/network_plugin/multus/templates/multus-daemonset.yml.j2 +++ b/kubespray/project/roles/network_plugin/multus/templates/multus-daemonset.yml.j2 @@ -24,6 +24,7 @@ spec: spec: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet + priorityClassName: system-node-critical nodeSelector: kubernetes.io/arch: {{ image_arch }} {% if container_manager_types | length >= 2 %} @@ -32,16 +33,35 @@ spec: tolerations: - operator: Exists serviceAccountName: multus + initContainers: + - name: install-multus-binary + image: {{ multus_image_repo }}:{{ multus_image_tag }} + command: ["/install_multus"] + args: + - "--type" + - "thin" + resources: + requests: + cpu: "10m" + memory: "15Mi" + securityContext: + privileged: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: cnibin + mountPath: {{ multus_cni_bin_dir }} + mountPropagation: Bidirectional containers: - name: kube-multus image: {{ multus_image_repo }}:{{ multus_image_tag }} - command: ["/entrypoint.sh"] + command: ["/thin_entrypoint"] args: - "--cni-conf-dir={{ multus_cni_conf_dir }}" + - "--multus-autoconfig-dir={{ multus_cni_conf_dir }}" - "--cni-bin-dir={{ multus_cni_bin_dir }}" - "--multus-conf-file={{ multus_conf_file }}" - "--multus-kubeconfig-file-host={{ multus_kubeconfig_file_host }}" - - "--cni-version={{ multus_cni_version }}" + - "--namespace-isolation={{ multus_namespace_isolation | string | lower }}" resources: requests: cpu: "100m" @@ -55,6 +75,7 @@ spec: capabilities: add: ["SYS_ADMIN"] {% endif %} + terminationMessagePolicy: FallbackToLogsOnError volumeMounts: {% if container_manager == 'crio' %} - name: run diff --git a/kubespray/project/roles/network_plugin/weave/defaults/main.yml b/kubespray/project/roles/network_plugin/weave/defaults/main.yml index 47469ae..337d8e7 100644 --- a/kubespray/project/roles/network_plugin/weave/defaults/main.yml +++ b/kubespray/project/roles/network_plugin/weave/defaults/main.yml @@ -18,7 +18,7 @@ weave_hairpin_mode: true # The range of IP addresses used by Weave Net and the subnet they are placed in # (CIDR format; default 10.32.0.0/12) -weave_ipalloc_range: "{{ kube_pods_subnet }}" +weave_ipalloc_range: "{{ kube_pods_subnets }}" # Set to 0 to disable Network Policy Controller (default is on) weave_expect_npc: "{{ enable_network_policy }}" diff --git a/kubespray/project/roles/recover_control_plane/OWNERS b/kubespray/project/roles/recover_control_plane/OWNERS deleted file mode 100644 index cb814a1..0000000 --- a/kubespray/project/roles/recover_control_plane/OWNERS +++ /dev/null @@ -1,8 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -approvers: - - qvicksilver - - yujunz -reviewers: - - qvicksilver - - yujunz diff --git a/kubespray/project/roles/recover_control_plane/control-plane/tasks/main.yml b/kubespray/project/roles/recover_control_plane/control-plane/tasks/main.yml index ec50f3f..2dc8113 100644 --- a/kubespray/project/roles/recover_control_plane/control-plane/tasks/main.yml +++ b/kubespray/project/roles/recover_control_plane/control-plane/tasks/main.yml @@ -15,14 +15,14 @@ environment: KUBECONFIG: "{{ ansible_env.HOME | default('/root') }}/.kube/config" with_items: "{{ groups['broken_kube_control_plane'] }}" - register: delete_broken_kube_masters + register: delete_broken_kube_control_plane_nodes failed_when: false when: groups['broken_kube_control_plane'] - name: Fail if unable to delete broken kube_control_plane nodes from cluster fail: msg: "Unable to delete broken kube_control_plane node: {{ item.item }}" - loop: "{{ delete_broken_kube_masters.results }}" + loop: "{{ delete_broken_kube_control_plane_nodes.results }}" changed_when: false when: - groups['broken_kube_control_plane'] diff --git a/kubespray/project/roles/recover_control_plane/post-recover/tasks/main.yml b/kubespray/project/roles/recover_control_plane/post-recover/tasks/main.yml index a62f912..5401d7d 100644 --- a/kubespray/project/roles/recover_control_plane/post-recover/tasks/main.yml +++ b/kubespray/project/roles/recover_control_plane/post-recover/tasks/main.yml @@ -6,10 +6,10 @@ etcd_servers: >- {% for host in groups['etcd'] -%} {% if not loop.last -%} - https://{{ hostvars[host].access_ip | default(hostvars[host].ip | default(hostvars[host].ansible_default_ipv4['address'])) }}:2379, + https://{{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:2379, {%- endif -%} {%- if loop.last -%} - https://{{ hostvars[host].access_ip | default(hostvars[host].ip | default(hostvars[host].ansible_default_ipv4['address'])) }}:2379 + https://{{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:2379 {%- endif -%} {%- endfor -%} diff --git a/kubespray/project/roles/remove-node/post-remove/tasks/main.yml b/kubespray/project/roles/remove-node/post-remove/tasks/main.yml index bc8bfd6..46c50c1 100644 --- a/kubespray/project/roles/remove-node/post-remove/tasks/main.yml +++ b/kubespray/project/roles/remove-node/post-remove/tasks/main.yml @@ -5,9 +5,9 @@ when: - groups['kube_control_plane'] | length > 0 # ignore servers that are not nodes - - inventory_hostname in groups['k8s_cluster'] and kube_override_hostname | default(inventory_hostname) in nodes.stdout_lines + - ('k8s_cluster' in group_names) and kube_override_hostname | default(inventory_hostname) in nodes.stdout_lines retries: "{{ delete_node_retries }}" - # Sometimes the api-server can have a short window of indisponibility when we delete a master node + # Sometimes the api-server can have a short window of indisponibility when we delete a control plane node delay: "{{ delete_node_delay_seconds }}" register: result until: result is not failed diff --git a/kubespray/project/roles/remove-node/pre-remove/tasks/main.yml b/kubespray/project/roles/remove-node/pre-remove/tasks/main.yml index 6f6c314..94d0ab2 100644 --- a/kubespray/project/roles/remove-node/pre-remove/tasks/main.yml +++ b/kubespray/project/roles/remove-node/pre-remove/tasks/main.yml @@ -1,43 +1,10 @@ --- -- name: Remove-node | List nodes - command: >- - {{ kubectl }} get nodes -o go-template={% raw %}'{{ range .items }}{{ .metadata.name }}{{ "\n" }}{{ end }}'{% endraw %} - register: nodes - when: - - groups['kube_control_plane'] | length > 0 - delegate_to: "{{ groups['kube_control_plane'] | first }}" - changed_when: false +- name: Warn for usage of deprecated role + fail: + msg: remove-node/pre-remove is deprecated, switch to remove_node/pre_remove + ignore_errors: true # noqa ignore-errors run_once: true -- name: Remove-node | Drain node except daemonsets resource - command: >- - {{ kubectl }} drain - --force - --ignore-daemonsets - --grace-period {{ drain_grace_period }} - --timeout {{ drain_timeout }} - --delete-emptydir-data {{ kube_override_hostname | default(inventory_hostname) }} - when: - - groups['kube_control_plane'] | length > 0 - # ignore servers that are not nodes - - kube_override_hostname | default(inventory_hostname) in nodes.stdout_lines - register: result - failed_when: result.rc != 0 and not allow_ungraceful_removal - delegate_to: "{{ groups['kube_control_plane'] | first }}" - until: result.rc == 0 or allow_ungraceful_removal - retries: "{{ drain_retries }}" - delay: "{{ drain_retry_delay_seconds }}" - -- name: Remove-node | Wait until Volumes will be detached from the node - command: >- - {{ kubectl }} get volumeattachments -o go-template={% raw %}'{{ range .items }}{{ .spec.nodeName }}{{ "\n" }}{{ end }}'{% endraw %} - register: nodes_with_volumes - delegate_to: "{{ groups['kube_control_plane'] | first }}" - changed_when: false - until: not (kube_override_hostname | default(inventory_hostname) in nodes_with_volumes.stdout_lines) - retries: 3 - delay: "{{ drain_grace_period }}" - when: - - groups['kube_control_plane'] | length > 0 - - not allow_ungraceful_removal - - kube_override_hostname | default(inventory_hostname) in nodes.stdout_lines +- name: Compat for direct role import + import_role: + name: remove_node/pre_remove diff --git a/kubespray/project/roles/remove-node/remove-etcd-node/tasks/main.yml b/kubespray/project/roles/remove-node/remove-etcd-node/tasks/main.yml index f0f0e17..d4efed0 100644 --- a/kubespray/project/roles/remove-node/remove-etcd-node/tasks/main.yml +++ b/kubespray/project/roles/remove-node/remove-etcd-node/tasks/main.yml @@ -2,50 +2,14 @@ - name: Lookup node IP in kubernetes command: > {{ kubectl }} get nodes {{ node }} - -o jsonpath='{range .status.addresses[?(@.type=="InternalIP")]}{@.address}{"\n"}{end}' - register: remove_node_ip - when: - - groups['kube_control_plane'] | length > 0 - - inventory_hostname in groups['etcd'] - - ip is not defined - - access_ip is not defined - delegate_to: "{{ groups['etcd'] | first }}" - failed_when: false - -- name: Set node IP - set_fact: - node_ip: "{{ ip | default(access_ip | default(remove_node_ip.stdout)) | trim }}" - when: - - inventory_hostname in groups['etcd'] - -- name: Make sure node_ip is set - assert: - that: node_ip is defined and node_ip | length > 0 - msg: "Etcd node ip is not set !" - when: - - inventory_hostname in groups['etcd'] - -- name: Lookup etcd member id - shell: "set -o pipefail && {{ bin_dir }}/etcdctl member list | grep -w {{ node_ip }} | cut -d, -f1" - args: - executable: /bin/bash - register: etcd_member_id - ignore_errors: true # noqa ignore-errors + -o jsonpath-as-json='{.status.addresses[?(@.type=="InternalIP")].address}' + register: k8s_node_ips changed_when: false - check_mode: false - tags: - - facts - environment: - ETCDCTL_API: "3" - ETCDCTL_CERT: "{{ kube_cert_dir + '/etcd/server.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd'] | first + '.pem' }}" - ETCDCTL_KEY: "{{ kube_cert_dir + '/etcd/server.key' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd'] | first + '-key.pem' }}" - ETCDCTL_CACERT: "{{ kube_cert_dir + '/etcd/ca.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/ca.pem' }}" - ETCDCTL_ENDPOINTS: "https://127.0.0.1:2379" - delegate_to: "{{ groups['etcd'] | first }}" - when: inventory_hostname in groups['etcd'] + when: + - groups['kube_control_plane'] | length > 0 + delegate_to: "{{ groups['kube_control_plane'] | first }}" - name: Remove etcd member from cluster - command: "{{ bin_dir }}/etcdctl member remove {{ etcd_member_id.stdout }}" environment: ETCDCTL_API: "3" ETCDCTL_CERT: "{{ kube_cert_dir + '/etcd/server.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/admin-' + groups['etcd'] | first + '.pem' }}" @@ -53,6 +17,27 @@ ETCDCTL_CACERT: "{{ kube_cert_dir + '/etcd/ca.crt' if etcd_deployment_type == 'kubeadm' else etcd_cert_dir + '/ca.pem' }}" ETCDCTL_ENDPOINTS: "https://127.0.0.1:2379" delegate_to: "{{ groups['etcd'] | first }}" - when: - - inventory_hostname in groups['etcd'] - - etcd_member_id.stdout | length > 0 + block: + - name: Lookup members infos + command: "{{ bin_dir }}/etcdctl member list" + register: etcd_members + changed_when: false + check_mode: false + tags: + - facts + - name: Remove member from cluster + vars: + node_ip: >- + {%- if not ipv4_stack -%} + {{ ip6 if ip6 is defined else (access_ip6 if access_ip6 is defined else (k8s_node_ips.stdout | from_json)[0]) | ansible.utils.ipwrap }} + {%- else -%} + {{ ip if ip is defined else (access_ip if access_ip is defined else (k8s_node_ips.stdout | from_json)[0]) | ansible.utils.ipwrap }} + {%- endif -%} + command: + argv: + - "{{ bin_dir }}/etcdctl" + - member + - remove + - "{{ ((etcd_members.stdout_lines | select('contains', '//' + node_ip + ':'))[0] | split(','))[0] }}" + register: etcd_removal_output + changed_when: "'Removed member' in etcd_removal_output.stdout" diff --git a/kubespray/project/roles/remove-node/pre-remove/defaults/main.yml b/kubespray/project/roles/remove_node/pre_remove/defaults/main.yml similarity index 100% rename from kubespray/project/roles/remove-node/pre-remove/defaults/main.yml rename to kubespray/project/roles/remove_node/pre_remove/defaults/main.yml diff --git a/kubespray/project/roles/remove_node/pre_remove/tasks/main.yml b/kubespray/project/roles/remove_node/pre_remove/tasks/main.yml new file mode 100644 index 0000000..6f6c314 --- /dev/null +++ b/kubespray/project/roles/remove_node/pre_remove/tasks/main.yml @@ -0,0 +1,43 @@ +--- +- name: Remove-node | List nodes + command: >- + {{ kubectl }} get nodes -o go-template={% raw %}'{{ range .items }}{{ .metadata.name }}{{ "\n" }}{{ end }}'{% endraw %} + register: nodes + when: + - groups['kube_control_plane'] | length > 0 + delegate_to: "{{ groups['kube_control_plane'] | first }}" + changed_when: false + run_once: true + +- name: Remove-node | Drain node except daemonsets resource + command: >- + {{ kubectl }} drain + --force + --ignore-daemonsets + --grace-period {{ drain_grace_period }} + --timeout {{ drain_timeout }} + --delete-emptydir-data {{ kube_override_hostname | default(inventory_hostname) }} + when: + - groups['kube_control_plane'] | length > 0 + # ignore servers that are not nodes + - kube_override_hostname | default(inventory_hostname) in nodes.stdout_lines + register: result + failed_when: result.rc != 0 and not allow_ungraceful_removal + delegate_to: "{{ groups['kube_control_plane'] | first }}" + until: result.rc == 0 or allow_ungraceful_removal + retries: "{{ drain_retries }}" + delay: "{{ drain_retry_delay_seconds }}" + +- name: Remove-node | Wait until Volumes will be detached from the node + command: >- + {{ kubectl }} get volumeattachments -o go-template={% raw %}'{{ range .items }}{{ .spec.nodeName }}{{ "\n" }}{{ end }}'{% endraw %} + register: nodes_with_volumes + delegate_to: "{{ groups['kube_control_plane'] | first }}" + changed_when: false + until: not (kube_override_hostname | default(inventory_hostname) in nodes_with_volumes.stdout_lines) + retries: 3 + delay: "{{ drain_grace_period }}" + when: + - groups['kube_control_plane'] | length > 0 + - not allow_ungraceful_removal + - kube_override_hostname | default(inventory_hostname) in nodes.stdout_lines diff --git a/kubespray/project/roles/reset/defaults/main.yml b/kubespray/project/roles/reset/defaults/main.yml index 1e84da7..293068c 100644 --- a/kubespray/project/roles/reset/defaults/main.yml +++ b/kubespray/project/roles/reset/defaults/main.yml @@ -2,21 +2,5 @@ flush_iptables: true reset_restart_network: true -reset_restart_network_service_name: >- - {% if ansible_os_family == "RedHat" -%} - {%- - if ansible_distribution_major_version | int >= 8 - or is_fedora_coreos or ansible_distribution in ["Fedora", "Kylin Linux Advanced Server", "TencentOS"] -%} - NetworkManager - {%- else -%} - network - {%- endif -%} - {%- elif ansible_distribution == "Ubuntu" - or (ansible_distribution == "Debian" and ansible_distribution_major_version | int == 12 ) -%} - systemd-networkd - {%- elif ansible_os_family == "Debian" -%} - networking - {%- endif %} - # crictl stop container grace period cri_stop_containers_grace_period: 0 diff --git a/kubespray/project/roles/reset/tasks/main.yml b/kubespray/project/roles/reset/tasks/main.yml index acafb5a..18e9622 100644 --- a/kubespray/project/roles/reset/tasks/main.yml +++ b/kubespray/project/roles/reset/tasks/main.yml @@ -3,6 +3,7 @@ service: name: "{{ item }}" state: stopped + enabled: false with_items: - kubelet.service - cri-dockerd.service @@ -188,7 +189,7 @@ - nat - mangle - raw - when: flush_iptables | bool + when: flush_iptables | bool and ipv4_stack tags: - iptables @@ -202,7 +203,7 @@ - nat - mangle - raw - when: flush_iptables | bool and enable_dual_stack_networks + when: flush_iptables | bool and ipv6_stack tags: - ip6tables @@ -210,7 +211,7 @@ command: "ipvsadm -C" ignore_errors: true # noqa ignore-errors when: - - kube_proxy_mode == 'ipvs' and inventory_hostname in groups['k8s_cluster'] + - kube_proxy_mode == 'ipvs' and 'k8s_cluster' in group_names - name: Reset | check kube-ipvs0 network device stat: @@ -290,6 +291,7 @@ - /var/log/openvswitch - /var/log/ovn - /var/log/kube-ovn + - /var/log/containers - /etc/cni - /etc/nerdctl - "{{ nginx_config_dir }}" @@ -345,9 +347,6 @@ - /etc/bash_completion.d/kubectl.sh - /etc/bash_completion.d/crictl - /etc/bash_completion.d/nerdctl - - /etc/bash_completion.d/krew - - /etc/bash_completion.d/krew.sh - - "{{ krew_root_dir }}" - /etc/modules-load.d/kube_proxy-ipvs.conf - /etc/modules-load.d/kubespray-br_netfilter.conf - /etc/modules-load.d/kubespray-kata-containers.conf @@ -412,12 +411,27 @@ - network - name: Reset | Restart network - service: - name: "{{ reset_restart_network_service_name }}" - state: restarted when: - ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] - reset_restart_network | bool tags: - services - network + block: + - name: Gather active network services + systemd: + name: "{{ item }}" + loop: + - NetworkManager + - systemd-networkd + - networking + - network + register: service_status + changed_when: false + ignore_errors: true + + - name: Restart active network services + systemd: + name: "{{ item }}" + state: restarted + loop: "{{ service_status.results | selectattr('status.ActiveState', '==', 'active') | map(attribute='item') }}" diff --git a/kubespray/project/roles/system_packages/defaults/main.yml b/kubespray/project/roles/system_packages/defaults/main.yml new file mode 100644 index 0000000..6270406 --- /dev/null +++ b/kubespray/project/roles/system_packages/defaults/main.yml @@ -0,0 +1,4 @@ +--- +# number of times package install task should be retried +pkg_install_retries: 4 +yum_repo_dir: /etc/yum.repos.d diff --git a/kubespray/project/roles/kubernetes/preinstall/tasks/0070-system-packages.yml b/kubespray/project/roles/system_packages/tasks/main.yml similarity index 57% rename from kubespray/project/roles/kubernetes/preinstall/tasks/0070-system-packages.yml rename to kubespray/project/roles/system_packages/tasks/main.yml index c8b480c..97d0cbb 100644 --- a/kubespray/project/roles/kubernetes/preinstall/tasks/0070-system-packages.yml +++ b/kubespray/project/roles/system_packages/tasks/main.yml @@ -1,4 +1,10 @@ --- +- name: Gather OS information + setup: + gather_subset: + - distribution + - pkg_mgr + - name: Update package management cache (zypper) - SUSE command: zypper -n --gpg-auto-import-keys ref register: make_cache_output @@ -7,14 +13,14 @@ delay: "{{ retry_stagger | random + 3 }}" when: - ansible_pkg_mgr == 'zypper' - tags: bootstrap-os + tags: bootstrap_os - name: Add debian 10 required repos when: - ansible_distribution == "Debian" - ansible_distribution_version == "10" tags: - - bootstrap-os + - bootstrap_os block: - name: Add Debian Backports apt repo apt_repository: @@ -38,7 +44,7 @@ cache_valid_time: 3600 when: ansible_os_family == "Debian" tags: - - bootstrap-os + - bootstrap_os - name: Remove legacy docker repo file file: @@ -57,31 +63,21 @@ - not is_fedora_coreos - epel_enabled | bool tags: - - bootstrap-os + - bootstrap_os -- name: Install packages requirements - vars: - # The json_query for selecting packages name is split for readability - # see files/pkgs-schema.json for the structure of `pkgs` - # and the matching semantics - full_query: "[? value | (enabled == null || enabled) && ( {{ filters_os }} ) && ( {{ filters_groups }} ) ].key" - filters_groups: "groups | @ == null || [? contains(`{{ group_names }}`, @)]" - filters_os: "os == null || (os | ( {{ filters_family }} ) || ( {{ filters_distro }} ))" - dquote: !unsafe '"' - # necessary to workaround Ansible escaping - filters_distro: "distributions.{{ dquote }}{{ ansible_distribution }}{{ dquote }} | - @ == `{}` || - contains(not_null(major_versions, `[]`), '{{ ansible_distribution_major_version }}') || - contains(not_null(versions, `[]`), '{{ ansible_distribution_version }}') || - contains(not_null(releases, `[]`), '{{ ansible_distribution_release }}')" - filters_family: "families && contains(families, '{{ ansible_os_family }}')" +- name: Manage packages package: - name: "{{ pkgs | dict2items | to_json|from_json | community.general.json_query(full_query) }}" - state: present + name: "{{ item.packages | dict2items | selectattr('value', 'ansible.builtin.all') | map(attribute='key') }}" + state: "{{ item.state }}" register: pkgs_task_result until: pkgs_task_result is succeeded retries: "{{ pkg_install_retries }}" delay: "{{ retry_stagger | random + 3 }}" when: not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos) + loop: + - { packages: "{{ pkgs_to_remove }}", state: "absent", action_label: "remove" } + - { packages: "{{ pkgs }}", state: "present", action_label: "install" } + loop_control: + label: "{{ item.action_label }}" tags: - - bootstrap-os + - bootstrap_os diff --git a/kubespray/project/roles/system_packages/vars/main.yml b/kubespray/project/roles/system_packages/vars/main.yml new file mode 100644 index 0000000..b269240 --- /dev/null +++ b/kubespray/project/roles/system_packages/vars/main.yml @@ -0,0 +1,102 @@ +--- +pkgs_to_remove: + systemd-timesyncd: + - "{{ ntp_enabled }}" + - "{{ ntp_package == 'ntp' }}" + - "{{ ansible_os_family == 'Debian' }}" +pkgs: + apparmor: + - "{{ ansible_os_family == 'Debian' }}" + apt-transport-https: + - "{{ ansible_os_family == 'Debian' }}" + aufs-tools: + - "{{ ansible_os_family == 'Debian' }}" + - "{{ ansible_distribution_major_version == '10' }}" + - "{{ 'k8s_cluster' in group_names }}" + bash-completion: [] + chrony: + - "{{ ntp_enabled }}" + - "{{ ntp_package == 'chrony' }}" + conntrack: + - "{{ ansible_os_family in ['Debian', 'RedHat'] }}" + - "{{ ansible_distribution != 'openEuler' }}" + - "{{ 'k8s_cluster' in group_names }}" + conntrack-tools: + - "{{ ansible_os_family == 'Suse' or ansible_distribution in ['Amazon', 'openEuler'] }}" + - "{{ 'k8s_cluster' in group_names }}" + container-selinux: + - "{{ ansible_os_family == 'RedHat' }}" + - "{{ 'k8s_cluster' in group_names }}" + curl: [] + device-mapper: + - "{{ ansible_os_family == 'Suse' or ansible_distribution == 'openEuler' }}" + - "{{ 'k8s_cluster' in group_names }}" + device-mapper-libs: + - "{{ ansible_os_family == 'RedHat' }}" + - "{{ ansible_distribution != 'openEuler' }}" + e2fsprogs: [] + ebtables: [] + gnupg: + - "{{ ansible_distribution == 'Debian' }}" + - "{{ ansible_distribution_major_version in ['11', '12'] }}" + - "{{ 'k8s_cluster' in group_names }}" + iproute: + - "{{ ansible_os_family == 'RedHat' }}" + iproute2: + - "{{ ansible_os_family != 'RedHat' }}" + ipset: + - "{{ kube_proxy_mode != 'ipvs' }}" + - "{{ 'k8s_cluster' in group_names }}" + iptables: + - "{{ ansible_os_family in ['Debian', 'RedHat'] }}" + iputils: + - "{{ not ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk', 'Debian'] }}" + - "{{ main_access_ip is defined }}" + - "{{ ping_access_ip }}" + - "{{ not is_fedora_coreos }}" + iputils-ping: + - "{{ ansible_os_family == 'Debian' }}" + - "{{ main_access_ip is defined }}" + - "{{ ping_access_ip }}" + ipvsadm: + - "{{ kube_proxy_mode == 'ipvs' }}" + - "{{ 'k8s_cluster' in group_names }}" + libseccomp: + - "{{ ansible_os_family == 'RedHat' }}" + libseccomp2: + - "{{ ansible_os_family in ['Debian', 'Suse'] }}" + - "{{ 'k8s_cluster' in group_names }}" + libselinux-python: + - "{{ ansible_distribution == 'Amazon' }}" + libselinux-python3: + - "{{ ansible_distribution == 'Fedora' }}" + mergerfs: + - "{{ ansible_distribution == 'Debian' }}" + - "{{ ansible_distribution_major_version == '12' }}" + nftables: + - "{{ kube_proxy_mode == 'nftables' }}" + - "{{ 'k8s_cluster' in group_names }}" + nss: + - "{{ ansible_os_family == 'RedHat' }}" + ntp: + - "{{ ntp_enabled }}" + - "{{ ntp_package == 'ntp' }}" + ntpsec: + - "{{ ntp_enabled }}" + - "{{ ntp_package == 'ntpsec' }}" + openssl: [] + python-apt: + - "{{ ansible_os_family == 'Debian' }}" + - "{{ ansible_distribution_major_version == '10' }}" + python3-apt: + - "{{ ansible_os_family == 'Debian' }}" + - "{{ ansible_distribution_major_version != '10' }}" + python3-libselinux: + - "{{ ansible_distribution in ['RedHat', 'CentOS'] }}" + rsync: [] + socat: [] + software-properties-common: + - "{{ ansible_os_family == 'Debian' }}" + tar: [] + unzip: [] + xfsprogs: [] diff --git a/kubespray/project/roles/validate_inventory/meta/main.yml b/kubespray/project/roles/validate_inventory/meta/main.yml new file mode 100644 index 0000000..5b1432e --- /dev/null +++ b/kubespray/project/roles/validate_inventory/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: kubespray_defaults diff --git a/kubespray/project/roles/validate_inventory/tasks/main.yml b/kubespray/project/roles/validate_inventory/tasks/main.yml new file mode 100644 index 0000000..f75cd95 --- /dev/null +++ b/kubespray/project/roles/validate_inventory/tasks/main.yml @@ -0,0 +1,270 @@ +--- +# This should only contains check of the inventory itself, nothing depending on facts +# Checks depending on current state (of the nodes or the cluster) +# should be in roles/kubernetes/preinstall/tasks/0040-verify-settings.yml +- name: Stop if some versions have a 'v' left at the start + # TODO: drop this task after 2.28.0 is released + # The 'not defined' tests are exception for applications which version in not defined + # in kubespray_defaults, only in their own roles. + assert: + msg: | + All version string used in kubespray have been normalized to not use a leading 'v'. + This check will be dropped in the next minor release. + that: + - argocd_version is not defined or not argocd_version.startswith('v') + - not aws_ebs_csi_plugin_version.startswith('v') + - not azure_csi_plugin_version.startswith('v') + - not calico_version.startswith('v') + - not calico_apiserver_version.startswith('v') + - not calico_ctl_version.startswith('v') + - not calico_typha_version.startswith('v') + - not cert_manager_version.startswith('v') + - not cilium_cli_version.startswith('v') + - not cilium_version.startswith('v') + - not cinder_csi_plugin_version.startswith('v') + - not cni_version.startswith('v') + - not dnsautoscaler_version.startswith('v') + - not flannel_cni_version.startswith('v') + - not flannel_version.startswith('v') + - gateway_api_version is not defined or not gateway_api_version.startswith('v') + - not gcp_pd_csi_plugin_version.startswith('v') + - not helm_version.startswith('v') + - not kube_ovn_version.startswith('v') + - not kube_router_version.startswith('v') + - not kube_version.startswith('v') + - kube_vip_version is not defined or not kube_vip_version.startswith('v') + - not local_path_provisioner_version.startswith('v') + - not local_volume_provisioner_version.startswith('v') + - not metallb_version.startswith('v') + - not metrics_server_version.startswith('v') + - not multus_version.startswith('v') + - not netcheck_version.startswith('v') + - not runc_version.startswith('v') + - not skopeo_version.startswith('v') + - not yq_version.startswith('v') + +- name: Stop if some derived versions have a 'v' left at the start + # TODO: drop this task after 2.28.0 is released + # The 'not defined' tests are exception for applications which version in not defined + # in kubespray_defaults, only in their own roles. + assert: + msg: | + All version string used in kubespray have been normalized to not use a leading 'v'. + This check will be dropped in the next minor release. + that: + - not etcd_version.startswith('v') + - not pod_infra_version.startswith('v') + +- name: Stop if kube_control_plane group is empty + assert: + that: groups.get( 'kube_control_plane' ) + run_once: true + when: not ignore_assert_errors + +- name: Stop if etcd group is empty in external etcd mode + assert: + that: groups.get('etcd') or etcd_deployment_type == 'kubeadm' + fail_msg: "Group 'etcd' cannot be empty in external etcd mode" + run_once: true + when: + - not ignore_assert_errors + +- name: Warn if `kube_network_plugin` is `none + debug: + msg: | + "WARNING! => `kube_network_plugin` is set to `none`. The network configuration will be skipped. + The cluster won't be ready to use, we recommend to select one of the available plugins" + when: + - kube_network_plugin == 'none' + +- name: Stop if unsupported version of Kubernetes + assert: + that: kube_version is version(kube_version_min_required, '>=') + msg: "The current release of Kubespray only support newer version of Kubernetes than {{ kube_version_min_required }} - You are trying to apply {{ kube_version }}" + when: not ignore_assert_errors + +- name: "Stop if known booleans are set as strings (Use JSON format on CLI: -e \"{'key': true }\")" + assert: + that: + - download_run_once | type_debug == 'bool' + - deploy_netchecker | type_debug == 'bool' + - download_always_pull | type_debug == 'bool' + - helm_enabled | type_debug == 'bool' + - openstack_lbaas_enabled | type_debug == 'bool' + run_once: true + when: not ignore_assert_errors + +- name: Stop if even number of etcd hosts + assert: + that: groups.get('etcd', groups.kube_control_plane) | length is not divisibleby 2 + run_once: true + when: + - not ignore_assert_errors + +# This assertion will fail on the safe side: One can indeed schedule more pods +# on a node than the CIDR-range has space for when additional pods use the host +# network namespace. It is impossible to ascertain the number of such pods at +# provisioning time, so to establish a guarantee, we factor these out. +# NOTICE: the check blatantly ignores the inet6-case +- name: Guarantee that enough network address space is available for all pods + assert: + that: "{{ (kubelet_max_pods | default(110)) | int <= (2 ** (32 - kube_network_node_prefix | int)) - 2 }}" + msg: "Do not schedule more pods on a node than inet addresses are available." + when: + - not ignore_assert_errors + - ('k8s_cluster' in group_names) + - kube_network_plugin not in ['calico', 'none'] + - ipv4_stack | bool + +- name: Stop if RBAC is not enabled when dashboard is enabled + assert: + that: rbac_enabled + when: + - dashboard_enabled + - not ignore_assert_errors + +- name: Check cloud_provider value + assert: + that: cloud_provider == 'external' + when: + - cloud_provider + - not ignore_assert_errors + +- name: Check external_cloud_provider value + assert: + that: external_cloud_provider in ['hcloud', 'huaweicloud', 'oci', 'openstack', 'vsphere', 'manual'] + when: + - cloud_provider == 'external' + - not ignore_assert_errors + +- name: "Check that kube_service_addresses is a network range" + assert: + that: + - kube_service_addresses | ansible.utils.ipaddr('net') + msg: "kube_service_addresses = '{{ kube_service_addresses }}' is not a valid network range" + run_once: true + when: ipv4_stack | bool + +- name: "Check that kube_pods_subnet is a network range" + assert: + that: + - kube_pods_subnet | ansible.utils.ipaddr('net') + msg: "kube_pods_subnet = '{{ kube_pods_subnet }}' is not a valid network range" + run_once: true + when: ipv4_stack | bool + +- name: "Check that kube_pods_subnet does not collide with kube_service_addresses" + assert: + that: + - kube_pods_subnet | ansible.utils.ipaddr(kube_service_addresses) | string == 'None' + msg: "kube_pods_subnet cannot be the same network segment as kube_service_addresses" + run_once: true + when: ipv4_stack | bool + +- name: "Check that ipv4 IP range is enough for the nodes" + assert: + that: + - 2 ** (kube_network_node_prefix - kube_pods_subnet | ansible.utils.ipaddr('prefix')) >= groups['k8s_cluster'] | length + msg: "Not enough ipv4 IPs are available for the desired node count." + when: + - ipv4_stack | bool + - kube_network_plugin != 'calico' + run_once: true + +- name: "Check that kube_service_addresses_ipv6 is a network range" + assert: + that: + - kube_service_addresses_ipv6 | ansible.utils.ipaddr('net') + msg: "kube_service_addresses_ipv6 = '{{ kube_service_addresses_ipv6 }}' is not a valid network range" + run_once: true + when: ipv6_stack | bool + +- name: "Check that kube_pods_subnet_ipv6 is a network range" + assert: + that: + - kube_pods_subnet_ipv6 | ansible.utils.ipaddr('net') + msg: "kube_pods_subnet_ipv6 = '{{ kube_pods_subnet_ipv6 }}' is not a valid network range" + run_once: true + when: ipv6_stack | bool + +- name: "Check that kube_pods_subnet_ipv6 does not collide with kube_service_addresses_ipv6" + assert: + that: + - kube_pods_subnet_ipv6 | ansible.utils.ipaddr(kube_service_addresses_ipv6) | string == 'None' + msg: "kube_pods_subnet_ipv6 cannot be the same network segment as kube_service_addresses_ipv6" + run_once: true + when: ipv6_stack | bool + +- name: "Check that ipv6 IP range is enough for the nodes" + assert: + that: + - 2 ** (kube_network_node_prefix_ipv6 - kube_pods_subnet_ipv6 | ansible.utils.ipaddr('prefix')) >= groups['k8s_cluster'] | length + msg: "Not enough ipv6 IPs are available for the desired node count." + when: + - ipv6_stack | bool + - kube_network_plugin != 'calico' + run_once: true + +- name: Stop if unsupported options selected + assert: + that: + - kube_network_plugin in ['calico', 'flannel', 'weave', 'cloud', 'cilium', 'cni', 'kube-ovn', 'kube-router', 'macvlan', 'custom_cni', 'none'] + - dns_mode in ['coredns', 'coredns_dual', 'manual', 'none'] + - kube_proxy_mode in ['iptables', 'ipvs', 'nftables'] + - cert_management in ['script', 'none'] + - resolvconf_mode in ['docker_dns', 'host_resolvconf', 'none'] + - etcd_deployment_type in ['host', 'docker', 'kubeadm'] + - etcd_deployment_type in ['host', 'kubeadm'] or container_manager == 'docker' + - container_manager in ['docker', 'crio', 'containerd'] + msg: The selected choice is not supported + run_once: true + +- name: Warn if `enable_dual_stack_networks` is set + debug: + msg: "WARNING! => `enable_dual_stack_networks` deprecation. Please switch to using ipv4_stack and ipv6_stack." + when: + - enable_dual_stack_networks is defined + +# TODO: Clean this task up after 2.28 is released +- name: Stop if etcd_kubeadm_enabled is defined + run_once: true + assert: + that: etcd_kubeadm_enabled is not defined + msg: | + `etcd_kubeadm_enabled` is removed. + You can set `etcd_deployment_type` to `kubeadm` instead of setting `etcd_kubeadm_enabled` to `true`." + +- name: Stop if download_localhost is enabled but download_run_once is not + assert: + that: download_run_once + msg: "download_localhost requires enable download_run_once" + when: download_localhost + +- name: Stop if kata_containers_enabled is enabled when container_manager is docker + assert: + that: container_manager != 'docker' + msg: "kata_containers_enabled support only for containerd and crio-o. See https://github.com/kata-containers/documentation/blob/1.11.4/how-to/run-kata-with-k8s.md#install-a-cri-implementation for details" + when: kata_containers_enabled + +- name: Stop if gvisor_enabled is enabled when container_manager is not containerd + assert: + that: container_manager == 'containerd' + msg: "gvisor_enabled support only compatible with containerd. See https://github.com/kubernetes-sigs/kubespray/issues/7650 for details" + when: gvisor_enabled + +- name: Ensure minimum containerd version + assert: + that: containerd_version is version(containerd_min_version_required, '>=') + msg: "containerd_version is too low. Minimum version {{ containerd_min_version_required }}" + run_once: true + when: + - containerd_version not in ['latest', 'edge', 'stable'] + - container_manager == 'containerd' + +- name: Stop if auto_renew_certificates is enabled when certificates are managed externally (kube_external_ca_mode is true) + assert: + that: not auto_renew_certificates + msg: "Variable auto_renew_certificates must be disabled when CA are managed externally: kube_external_ca_mode = true" + when: + - kube_external_ca_mode + - not ignore_assert_errors diff --git a/kubespray/project/scale.yml b/kubespray/project/scale.yml index ef09366..1d0e242 100644 --- a/kubespray/project/scale.yml +++ b/kubespray/project/scale.yml @@ -5,22 +5,11 @@ - name: Gather facts import_playbook: facts.yml -- name: Generate the etcd certificates beforehand - hosts: etcd:kube_control_plane - gather_facts: false - any_errors_fatal: "{{ any_errors_fatal | default(true) }}" - environment: "{{ proxy_disable_env }}" - roles: - - { role: kubespray-defaults } - - role: etcd - tags: etcd - vars: - etcd_cluster_setup: false - etcd_events_cluster_setup: false - when: - - etcd_deployment_type != "kubeadm" - - kube_network_plugin in ["calico", "flannel", "canal", "cilium"] or cilium_deploy_additionally | default(false) | bool - - kube_network_plugin != "calico" or calico_datastore == "etcd" +- name: Install etcd + vars: + etcd_cluster_setup: false + etcd_events_cluster_setup: false + import_playbook: install_etcd.yml - name: Download images to ansible host cache via first kube_control_plane node hosts: kube_control_plane[0] @@ -28,7 +17,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults, when: "not skip_downloads and download_run_once and not download_localhost" } + - { role: kubespray_defaults, when: "not skip_downloads and download_run_once and not download_localhost" } - { role: kubernetes/preinstall, tags: preinstall, when: "not skip_downloads and download_run_once and not download_localhost" } - { role: download, tags: download, when: "not skip_downloads and download_run_once and not download_localhost" } @@ -38,7 +27,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/preinstall, tags: preinstall } - { role: container-engine, tags: "container-engine", when: deploy_container_engine } - { role: download, tags: download, when: "not skip_downloads" } @@ -57,7 +46,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/node, tags: node } - name: Upload control plane certs and retrieve encryption key @@ -66,7 +55,7 @@ gather_facts: false tags: kubeadm roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } tasks: - name: Upload control plane certificates command: >- @@ -88,7 +77,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/kubeadm, tags: kubeadm } - { role: kubernetes/node-label, tags: node-label } - { role: kubernetes/node-taint, tags: node-taint } @@ -100,5 +89,5 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true } diff --git a/kubespray/project/upgrade_cluster.yml b/kubespray/project/upgrade_cluster.yml index 99511a8..b0b3a08 100644 --- a/kubespray/project/upgrade_cluster.yml +++ b/kubespray/project/upgrade_cluster.yml @@ -11,7 +11,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults, when: "not skip_downloads and download_run_once and not download_localhost"} + - { role: kubespray_defaults, when: "not skip_downloads and download_run_once and not download_localhost"} - { role: kubernetes/preinstall, tags: preinstall, when: "not skip_downloads and download_run_once and not download_localhost" } - { role: download, tags: download, when: "not skip_downloads and download_run_once and not download_localhost" } @@ -21,7 +21,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/preinstall, tags: preinstall } - { role: download, tags: download, when: "not skip_downloads" } @@ -32,20 +32,23 @@ environment: "{{ proxy_disable_env }}" serial: "{{ serial | default('20%') }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: container-engine, tags: "container-engine", when: deploy_container_engine } - name: Install etcd + vars: + etcd_cluster_setup: true + etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}" import_playbook: install_etcd.yml -- name: Handle upgrades to master components first to maintain backwards compat. +- name: Handle upgrades to control plane components first to maintain backwards compat. gather_facts: false hosts: kube_control_plane any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" serial: 1 roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: upgrade/pre-upgrade, tags: pre-upgrade } - { role: upgrade/system-upgrade, tags: system-upgrade } - { role: download, tags: download, when: "system_upgrade and system_upgrade_reboot != 'never' and not skip_downloads" } @@ -60,14 +63,14 @@ - { role: kubernetes-apps, tags: csi-driver } - { role: upgrade/post-upgrade, tags: post-upgrade } -- name: Upgrade calico and external cloud provider on all masters, calico-rrs, and nodes +- name: Upgrade calico and external cloud provider on all control plane nodes, calico-rrs, and nodes hosts: kube_control_plane:calico_rr:kube_node gather_facts: false any_errors_fatal: "{{ any_errors_fatal | default(true) }}" serial: "{{ serial | default('20%') }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller } - { role: network_plugin, tags: network } - { role: kubernetes-apps/network_plugin, tags: network } @@ -80,7 +83,7 @@ environment: "{{ proxy_disable_env }}" serial: "{{ serial | default('20%') }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: upgrade/pre-upgrade, tags: pre-upgrade } - { role: upgrade/system-upgrade, tags: system-upgrade } - { role: download, tags: download, when: "system_upgrade and system_upgrade_reboot != 'never' and not skip_downloads" } @@ -97,7 +100,7 @@ any_errors_fatal: true environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] } - name: Install Calico Route Reflector @@ -106,7 +109,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: network_plugin/calico/rr, tags: network } - name: Install Kubernetes apps @@ -115,7 +118,7 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes-apps/ingress_controller, tags: ingress-controller } - { role: kubernetes-apps/external_provisioner, tags: external-provisioner } - { role: kubernetes-apps, tags: apps } @@ -126,5 +129,5 @@ any_errors_fatal: "{{ any_errors_fatal | default(true) }}" environment: "{{ proxy_disable_env }}" roles: - - { role: kubespray-defaults } + - { role: kubespray_defaults } - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true } diff --git a/requirements.txt b/requirements.txt index e3faa0a..bb9df86 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,10 +1,4 @@ -ansible==9.5.1 -cryptography==41.0.4 -jinja2==3.1.4 +ansible==9.13.0 +cryptography==45.0.2 jmespath==1.0.1 -MarkupSafe==2.1.5 -netaddr==1.2.1 -pbr==5.11.1 -ruamel.yaml==0.18.6 -ruamel.yaml.clib==0.2.8 -jsonschema==4.22.0 \ No newline at end of file +netaddr==1.3.0