mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-07-17 18:11:10 +02:00
Ryan Yin
3282 lines
214 KiB
YAML
3282 lines
214 KiB
YAML
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: networkaddonsconfigs.networkaddonsoperator.network.kubevirt.io
|
|
spec:
|
|
group: networkaddonsoperator.network.kubevirt.io
|
|
names:
|
|
kind: NetworkAddonsConfig
|
|
listKind: NetworkAddonsConfigList
|
|
plural: networkaddonsconfigs
|
|
singular: networkaddonsconfig
|
|
scope: Cluster
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NetworkAddonsConfig is the Schema for the networkaddonsconfigs
|
|
API
|
|
properties:
|
|
apiVersion:
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
type: string
|
|
kind:
|
|
description: 'Kind is a string value representing the REST resource this
|
|
object represents. Servers may infer this from the endpoint the client
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NetworkAddonsConfigSpec defines the desired state of NetworkAddonsConfig
|
|
properties:
|
|
imagePullPolicy:
|
|
description: PullPolicy describes a policy for if/when to pull a container
|
|
image
|
|
type: string
|
|
kubeMacPool:
|
|
description: KubeMacPool plugin manages MAC allocation to Pods and
|
|
VMs in Kubernetes
|
|
properties:
|
|
rangeEnd:
|
|
description: RangeEnd defines the first mac in range
|
|
type: string
|
|
rangeStart:
|
|
description: RangeStart defines the first mac in range
|
|
type: string
|
|
type: object
|
|
kubeSecondaryDNS:
|
|
description: KubeSecondaryDNS plugin allows to support FQDN for VMI's
|
|
secondary networks
|
|
properties:
|
|
domain:
|
|
description: Domain defines the FQDN domain
|
|
type: string
|
|
nameServerIP:
|
|
description: NameServerIp defines the name server IP
|
|
type: string
|
|
type: object
|
|
linuxBridge:
|
|
description: LinuxBridge plugin allows users to create a bridge and
|
|
add the host and the container to it
|
|
type: object
|
|
macvtap:
|
|
description: MacvtapCni plugin allows users to define Kubernetes networks
|
|
on top of existing host interfaces
|
|
properties:
|
|
devicePluginConfig:
|
|
description: DevicePluginConfig allows the user to override the
|
|
name of the `ConfigMap` where the device plugin configuration
|
|
is held
|
|
type: string
|
|
type: object
|
|
multus:
|
|
description: Multus plugin enables attaching multiple network interfaces
|
|
to Pods in Kubernetes
|
|
type: object
|
|
multusDynamicNetworks:
|
|
description: A multus extension enabling hot-plug and hot-unplug of
|
|
Pod interfaces
|
|
type: object
|
|
ovs:
|
|
description: Ovs plugin allows users to define Kubernetes networks
|
|
on top of Open vSwitch bridges available on nodes
|
|
type: object
|
|
placementConfiguration:
|
|
description: PlacementConfiguration defines node placement configuration
|
|
properties:
|
|
infra:
|
|
description: Infra defines placement configuration for control-plane
|
|
nodes
|
|
properties:
|
|
affinity:
|
|
description: Affinity is a group of affinity scheduling rules.
|
|
properties:
|
|
nodeAffinity:
|
|
description: Describes node affinity scheduling rules
|
|
for the pod.
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node matches the corresponding matchExpressions;
|
|
the node(s) with the highest sum are the most preferred.
|
|
items:
|
|
description: An empty preferred scheduling term
|
|
matches all objects with implicit weight 0 (i.e.
|
|
it's a no-op). A null preferred scheduling term
|
|
matches no objects (i.e. is also a no-op).
|
|
properties:
|
|
preference:
|
|
description: A node selector term, associated
|
|
with the corresponding weight.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
weight:
|
|
description: Weight associated with matching
|
|
the corresponding nodeSelectorTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- preference
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to an update), the system may or may not try
|
|
to eventually evict the pod from its node.
|
|
properties:
|
|
nodeSelectorTerms:
|
|
description: Required. A list of node selector
|
|
terms. The terms are ORed.
|
|
items:
|
|
description: A null or empty node selector term
|
|
matches no objects. The requirements of them
|
|
are ANDed. The TopologySelectorTerm type implements
|
|
a subset of the NodeSelectorTerm.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: array
|
|
required:
|
|
- nodeSelectorTerms
|
|
type: object
|
|
type: object
|
|
podAffinity:
|
|
description: Describes pod affinity scheduling rules (e.g.
|
|
co-locate this pod in the same node, zone, etc. as some
|
|
other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to a pod label update), the system may or may
|
|
not try to eventually evict the pod from its node.
|
|
When there are multiple elements, the lists of nodes
|
|
corresponding to each podAffinityTerm are intersected,
|
|
i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
podAntiAffinity:
|
|
description: Describes pod anti-affinity scheduling rules
|
|
(e.g. avoid putting this pod in the same node, zone,
|
|
etc. as some other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the anti-affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling anti-affinity
|
|
expressions, etc.), compute a sum by iterating through
|
|
the elements of this field and adding "weight" to
|
|
the sum if the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the anti-affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
anti-affinity requirements specified by this field
|
|
cease to be met at some point during pod execution
|
|
(e.g. due to a pod label update), the system may
|
|
or may not try to eventually evict the pod from
|
|
its node. When there are multiple elements, the
|
|
lists of nodes corresponding to each podAffinityTerm
|
|
are intersected, i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
nodeSelector:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
tolerations:
|
|
items:
|
|
description: The pod this Toleration is attached to tolerates
|
|
any taint that matches the triple <key,value,effect> using
|
|
the matching operator <operator>.
|
|
properties:
|
|
effect:
|
|
description: Effect indicates the taint effect to match.
|
|
Empty means match all taint effects. When specified,
|
|
allowed values are NoSchedule, PreferNoSchedule and
|
|
NoExecute.
|
|
type: string
|
|
key:
|
|
description: Key is the taint key that the toleration
|
|
applies to. Empty means match all taint keys. If the
|
|
key is empty, operator must be Exists; this combination
|
|
means to match all values and all keys.
|
|
type: string
|
|
operator:
|
|
description: Operator represents a key's relationship
|
|
to the value. Valid operators are Exists and Equal.
|
|
Defaults to Equal. Exists is equivalent to wildcard
|
|
for value, so that a pod can tolerate all taints of
|
|
a particular category.
|
|
type: string
|
|
tolerationSeconds:
|
|
description: TolerationSeconds represents the period
|
|
of time the toleration (which must be of effect NoExecute,
|
|
otherwise this field is ignored) tolerates the taint.
|
|
By default, it is not set, which means tolerate the
|
|
taint forever (do not evict). Zero and negative values
|
|
will be treated as 0 (evict immediately) by the system.
|
|
format: int64
|
|
type: integer
|
|
value:
|
|
description: Value is the taint value the toleration
|
|
matches to. If the operator is Exists, the value should
|
|
be empty, otherwise just a regular string.
|
|
type: string
|
|
type: object
|
|
type: array
|
|
type: object
|
|
workloads:
|
|
properties:
|
|
affinity:
|
|
description: Affinity is a group of affinity scheduling rules.
|
|
properties:
|
|
nodeAffinity:
|
|
description: Describes node affinity scheduling rules
|
|
for the pod.
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node matches the corresponding matchExpressions;
|
|
the node(s) with the highest sum are the most preferred.
|
|
items:
|
|
description: An empty preferred scheduling term
|
|
matches all objects with implicit weight 0 (i.e.
|
|
it's a no-op). A null preferred scheduling term
|
|
matches no objects (i.e. is also a no-op).
|
|
properties:
|
|
preference:
|
|
description: A node selector term, associated
|
|
with the corresponding weight.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
weight:
|
|
description: Weight associated with matching
|
|
the corresponding nodeSelectorTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- preference
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to an update), the system may or may not try
|
|
to eventually evict the pod from its node.
|
|
properties:
|
|
nodeSelectorTerms:
|
|
description: Required. A list of node selector
|
|
terms. The terms are ORed.
|
|
items:
|
|
description: A null or empty node selector term
|
|
matches no objects. The requirements of them
|
|
are ANDed. The TopologySelectorTerm type implements
|
|
a subset of the NodeSelectorTerm.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: array
|
|
required:
|
|
- nodeSelectorTerms
|
|
type: object
|
|
type: object
|
|
podAffinity:
|
|
description: Describes pod affinity scheduling rules (e.g.
|
|
co-locate this pod in the same node, zone, etc. as some
|
|
other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to a pod label update), the system may or may
|
|
not try to eventually evict the pod from its node.
|
|
When there are multiple elements, the lists of nodes
|
|
corresponding to each podAffinityTerm are intersected,
|
|
i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
podAntiAffinity:
|
|
description: Describes pod anti-affinity scheduling rules
|
|
(e.g. avoid putting this pod in the same node, zone,
|
|
etc. as some other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the anti-affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling anti-affinity
|
|
expressions, etc.), compute a sum by iterating through
|
|
the elements of this field and adding "weight" to
|
|
the sum if the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the anti-affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
anti-affinity requirements specified by this field
|
|
cease to be met at some point during pod execution
|
|
(e.g. due to a pod label update), the system may
|
|
or may not try to eventually evict the pod from
|
|
its node. When there are multiple elements, the
|
|
lists of nodes corresponding to each podAffinityTerm
|
|
are intersected, i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
nodeSelector:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
tolerations:
|
|
items:
|
|
description: The pod this Toleration is attached to tolerates
|
|
any taint that matches the triple <key,value,effect> using
|
|
the matching operator <operator>.
|
|
properties:
|
|
effect:
|
|
description: Effect indicates the taint effect to match.
|
|
Empty means match all taint effects. When specified,
|
|
allowed values are NoSchedule, PreferNoSchedule and
|
|
NoExecute.
|
|
type: string
|
|
key:
|
|
description: Key is the taint key that the toleration
|
|
applies to. Empty means match all taint keys. If the
|
|
key is empty, operator must be Exists; this combination
|
|
means to match all values and all keys.
|
|
type: string
|
|
operator:
|
|
description: Operator represents a key's relationship
|
|
to the value. Valid operators are Exists and Equal.
|
|
Defaults to Equal. Exists is equivalent to wildcard
|
|
for value, so that a pod can tolerate all taints of
|
|
a particular category.
|
|
type: string
|
|
tolerationSeconds:
|
|
description: TolerationSeconds represents the period
|
|
of time the toleration (which must be of effect NoExecute,
|
|
otherwise this field is ignored) tolerates the taint.
|
|
By default, it is not set, which means tolerate the
|
|
taint forever (do not evict). Zero and negative values
|
|
will be treated as 0 (evict immediately) by the system.
|
|
format: int64
|
|
type: integer
|
|
value:
|
|
description: Value is the taint value the toleration
|
|
matches to. If the operator is Exists, the value should
|
|
be empty, otherwise just a regular string.
|
|
type: string
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
selfSignConfiguration:
|
|
description: SelfSignConfiguration defines self sign configuration
|
|
properties:
|
|
caOverlapInterval:
|
|
description: CAOverlapInterval defines the duration where expired
|
|
CA certificate can overlap with new one, in order to allow fluent
|
|
CA rotation transitioning
|
|
type: string
|
|
caRotateInterval:
|
|
description: CARotateInterval defines duration for CA expiration
|
|
type: string
|
|
certOverlapInterval:
|
|
description: CertOverlapInterval defines the duration where expired
|
|
service certificate can overlap with new one, in order to allow
|
|
fluent service rotation transitioning
|
|
type: string
|
|
certRotateInterval:
|
|
description: CertRotateInterval defines duration for of service
|
|
certificate expiration
|
|
type: string
|
|
type: object
|
|
tlsSecurityProfile:
|
|
description: TLSSecurityProfile defines the schema for a TLS security
|
|
profile. This object is used by operators to apply TLS security
|
|
settings to operands.
|
|
nullable: true
|
|
properties:
|
|
custom:
|
|
description: 'custom is a user-defined TLS security profile. Be
|
|
extremely careful using a custom profile as invalid configurations
|
|
can be catastrophic. An example custom profile looks like this:
|
|
ciphers: ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256
|
|
minTLSVersion: TLSv1.1'
|
|
nullable: true
|
|
properties:
|
|
ciphers:
|
|
description: |-
|
|
ciphers is used to specify the cipher algorithms that are negotiated during the TLS handshake. Operators may remove entries their operands do not support. For example, to use DES-CBC3-SHA (yaml):
|
|
ciphers: - DES-CBC3-SHA
|
|
items:
|
|
enum:
|
|
- TLS_AES_128_GCM_SHA256
|
|
- TLS_AES_256_GCM_SHA384
|
|
- TLS_CHACHA20_POLY1305_SHA256
|
|
- ECDHE-ECDSA-AES128-GCM-SHA256
|
|
- ECDHE-RSA-AES128-GCM-SHA256
|
|
- ECDHE-ECDSA-AES256-GCM-SHA384
|
|
- ECDHE-RSA-AES256-GCM-SHA384
|
|
- ECDHE-ECDSA-CHACHA20-POLY1305
|
|
- ECDHE-RSA-CHACHA20-POLY1305
|
|
- DHE-RSA-AES128-GCM-SHA256
|
|
- DHE-RSA-AES256-GCM-SHA384
|
|
- DHE-RSA-CHACHA20-POLY1305
|
|
- ECDHE-ECDSA-AES128-SHA256
|
|
- ECDHE-RSA-AES128-SHA256
|
|
- ECDHE-ECDSA-AES128-SHA
|
|
- ECDHE-RSA-AES128-SHA
|
|
- ECDHE-ECDSA-AES256-SHA384
|
|
- ECDHE-RSA-AES256-SHA384
|
|
- ECDHE-ECDSA-AES256-SHA
|
|
- ECDHE-RSA-AES256-SHA
|
|
- DHE-RSA-AES128-SHA256
|
|
- DHE-RSA-AES256-SHA256
|
|
- AES128-GCM-SHA256
|
|
- AES256-GCM-SHA384
|
|
- AES128-SHA256
|
|
- AES256-SHA256
|
|
- AES128-SHA
|
|
- AES256-SHA
|
|
- DES-CBC3-SHA
|
|
type: string
|
|
type: array
|
|
minTLSVersion:
|
|
description: |-
|
|
minTLSVersion is used to specify the minimal version of the TLS protocol that is negotiated during the TLS handshake. For example, to use TLS versions 1.1, 1.2 and 1.3 (yaml):
|
|
minTLSVersion: TLSv1.1
|
|
NOTE: currently the highest minTLSVersion allowed is VersionTLS12
|
|
enum:
|
|
- VersionTLS10
|
|
- VersionTLS11
|
|
- VersionTLS12
|
|
- VersionTLS13
|
|
type: string
|
|
type: object
|
|
intermediate:
|
|
description: |-
|
|
intermediate is a TLS security profile based on: https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29 and looks like this (yaml):
|
|
ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128-GCM-SHA256 - ECDHE-RSA-AE,SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AE,SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE,POLY1305,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES256-GCM-SHA384 minTLSVersion: TLSv1.2
|
|
nullable: true
|
|
type: object
|
|
modern:
|
|
description: 'modern is a TLS security profile based on: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
|
|
and looks like this (yaml): ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256
|
|
minTLSVersion: TLSv1.3 NOTE: Currently unsupported.'
|
|
nullable: true
|
|
type: object
|
|
old:
|
|
description: 'old is a TLS security profile based on: https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
|
|
and looks like this (yaml): ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES256-GCM-SHA384,DHE-RSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-RSA-AES128-SHA256,DHE-RSA-AES256-SHA256,AES128-GCM-SHA256,AES256-GCM-SHA384,AES128-SHA256,AES256-SHA256,AES128-SHA,AES256-SHA,DES-CBC3-SHA
|
|
minTLSVersion: TLSv1.0'
|
|
nullable: true
|
|
type: object
|
|
type:
|
|
description: |-
|
|
type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. Old, Intermediate and Modern are TLS security profiles based on:
|
|
https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.
|
|
Note that the Modern profile is currently not supported because it is not yet well adopted by common software libraries.
|
|
enum:
|
|
- Old
|
|
- Intermediate
|
|
- Modern
|
|
- Custom
|
|
type: string
|
|
type: object
|
|
type: object
|
|
status:
|
|
description: NetworkAddonsConfigStatus defines the observed state of NetworkAddonsConfig
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: Condition represents the state of the operator's reconciliation
|
|
functionality.
|
|
properties:
|
|
lastHeartbeatTime:
|
|
format: date-time
|
|
nullable: true
|
|
type: string
|
|
lastTransitionTime:
|
|
format: date-time
|
|
nullable: true
|
|
type: string
|
|
message:
|
|
type: string
|
|
reason:
|
|
type: string
|
|
status:
|
|
type: string
|
|
type:
|
|
description: ConditionType is the state of the operator's reconciliation
|
|
functionality.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
containers:
|
|
items:
|
|
properties:
|
|
image:
|
|
type: string
|
|
name:
|
|
type: string
|
|
parentKind:
|
|
type: string
|
|
parentName:
|
|
type: string
|
|
required:
|
|
- image
|
|
- name
|
|
- parentKind
|
|
- parentName
|
|
type: object
|
|
type: array
|
|
observedVersion:
|
|
type: string
|
|
operatorVersion:
|
|
type: string
|
|
targetVersion:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
- name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NetworkAddonsConfig is the Schema for the networkaddonsconfigs
|
|
API
|
|
properties:
|
|
apiVersion:
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
type: string
|
|
kind:
|
|
description: 'Kind is a string value representing the REST resource this
|
|
object represents. Servers may infer this from the endpoint the client
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NetworkAddonsConfigSpec defines the desired state of NetworkAddonsConfig
|
|
properties:
|
|
imagePullPolicy:
|
|
description: PullPolicy describes a policy for if/when to pull a container
|
|
image
|
|
type: string
|
|
kubeMacPool:
|
|
description: KubeMacPool plugin manages MAC allocation to Pods and
|
|
VMs in Kubernetes
|
|
properties:
|
|
rangeEnd:
|
|
description: RangeEnd defines the first mac in range
|
|
type: string
|
|
rangeStart:
|
|
description: RangeStart defines the first mac in range
|
|
type: string
|
|
type: object
|
|
kubeSecondaryDNS:
|
|
description: KubeSecondaryDNS plugin allows to support FQDN for VMI's
|
|
secondary networks
|
|
properties:
|
|
domain:
|
|
description: Domain defines the FQDN domain
|
|
type: string
|
|
nameServerIP:
|
|
description: NameServerIp defines the name server IP
|
|
type: string
|
|
type: object
|
|
linuxBridge:
|
|
description: LinuxBridge plugin allows users to create a bridge and
|
|
add the host and the container to it
|
|
type: object
|
|
macvtap:
|
|
description: MacvtapCni plugin allows users to define Kubernetes networks
|
|
on top of existing host interfaces
|
|
properties:
|
|
devicePluginConfig:
|
|
description: DevicePluginConfig allows the user to override the
|
|
name of the `ConfigMap` where the device plugin configuration
|
|
is held
|
|
type: string
|
|
type: object
|
|
multus:
|
|
description: Multus plugin enables attaching multiple network interfaces
|
|
to Pods in Kubernetes
|
|
type: object
|
|
multusDynamicNetworks:
|
|
description: A multus extension enabling hot-plug and hot-unplug of
|
|
Pod interfaces
|
|
type: object
|
|
ovs:
|
|
description: Ovs plugin allows users to define Kubernetes networks
|
|
on top of Open vSwitch bridges available on nodes
|
|
type: object
|
|
placementConfiguration:
|
|
description: PlacementConfiguration defines node placement configuration
|
|
properties:
|
|
infra:
|
|
description: Infra defines placement configuration for control-plane
|
|
nodes
|
|
properties:
|
|
affinity:
|
|
description: Affinity is a group of affinity scheduling rules.
|
|
properties:
|
|
nodeAffinity:
|
|
description: Describes node affinity scheduling rules
|
|
for the pod.
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node matches the corresponding matchExpressions;
|
|
the node(s) with the highest sum are the most preferred.
|
|
items:
|
|
description: An empty preferred scheduling term
|
|
matches all objects with implicit weight 0 (i.e.
|
|
it's a no-op). A null preferred scheduling term
|
|
matches no objects (i.e. is also a no-op).
|
|
properties:
|
|
preference:
|
|
description: A node selector term, associated
|
|
with the corresponding weight.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
weight:
|
|
description: Weight associated with matching
|
|
the corresponding nodeSelectorTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- preference
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to an update), the system may or may not try
|
|
to eventually evict the pod from its node.
|
|
properties:
|
|
nodeSelectorTerms:
|
|
description: Required. A list of node selector
|
|
terms. The terms are ORed.
|
|
items:
|
|
description: A null or empty node selector term
|
|
matches no objects. The requirements of them
|
|
are ANDed. The TopologySelectorTerm type implements
|
|
a subset of the NodeSelectorTerm.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: array
|
|
required:
|
|
- nodeSelectorTerms
|
|
type: object
|
|
type: object
|
|
podAffinity:
|
|
description: Describes pod affinity scheduling rules (e.g.
|
|
co-locate this pod in the same node, zone, etc. as some
|
|
other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to a pod label update), the system may or may
|
|
not try to eventually evict the pod from its node.
|
|
When there are multiple elements, the lists of nodes
|
|
corresponding to each podAffinityTerm are intersected,
|
|
i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
podAntiAffinity:
|
|
description: Describes pod anti-affinity scheduling rules
|
|
(e.g. avoid putting this pod in the same node, zone,
|
|
etc. as some other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the anti-affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling anti-affinity
|
|
expressions, etc.), compute a sum by iterating through
|
|
the elements of this field and adding "weight" to
|
|
the sum if the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the anti-affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
anti-affinity requirements specified by this field
|
|
cease to be met at some point during pod execution
|
|
(e.g. due to a pod label update), the system may
|
|
or may not try to eventually evict the pod from
|
|
its node. When there are multiple elements, the
|
|
lists of nodes corresponding to each podAffinityTerm
|
|
are intersected, i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
nodeSelector:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
tolerations:
|
|
items:
|
|
description: The pod this Toleration is attached to tolerates
|
|
any taint that matches the triple <key,value,effect> using
|
|
the matching operator <operator>.
|
|
properties:
|
|
effect:
|
|
description: Effect indicates the taint effect to match.
|
|
Empty means match all taint effects. When specified,
|
|
allowed values are NoSchedule, PreferNoSchedule and
|
|
NoExecute.
|
|
type: string
|
|
key:
|
|
description: Key is the taint key that the toleration
|
|
applies to. Empty means match all taint keys. If the
|
|
key is empty, operator must be Exists; this combination
|
|
means to match all values and all keys.
|
|
type: string
|
|
operator:
|
|
description: Operator represents a key's relationship
|
|
to the value. Valid operators are Exists and Equal.
|
|
Defaults to Equal. Exists is equivalent to wildcard
|
|
for value, so that a pod can tolerate all taints of
|
|
a particular category.
|
|
type: string
|
|
tolerationSeconds:
|
|
description: TolerationSeconds represents the period
|
|
of time the toleration (which must be of effect NoExecute,
|
|
otherwise this field is ignored) tolerates the taint.
|
|
By default, it is not set, which means tolerate the
|
|
taint forever (do not evict). Zero and negative values
|
|
will be treated as 0 (evict immediately) by the system.
|
|
format: int64
|
|
type: integer
|
|
value:
|
|
description: Value is the taint value the toleration
|
|
matches to. If the operator is Exists, the value should
|
|
be empty, otherwise just a regular string.
|
|
type: string
|
|
type: object
|
|
type: array
|
|
type: object
|
|
workloads:
|
|
properties:
|
|
affinity:
|
|
description: Affinity is a group of affinity scheduling rules.
|
|
properties:
|
|
nodeAffinity:
|
|
description: Describes node affinity scheduling rules
|
|
for the pod.
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node matches the corresponding matchExpressions;
|
|
the node(s) with the highest sum are the most preferred.
|
|
items:
|
|
description: An empty preferred scheduling term
|
|
matches all objects with implicit weight 0 (i.e.
|
|
it's a no-op). A null preferred scheduling term
|
|
matches no objects (i.e. is also a no-op).
|
|
properties:
|
|
preference:
|
|
description: A node selector term, associated
|
|
with the corresponding weight.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
weight:
|
|
description: Weight associated with matching
|
|
the corresponding nodeSelectorTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- preference
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to an update), the system may or may not try
|
|
to eventually evict the pod from its node.
|
|
properties:
|
|
nodeSelectorTerms:
|
|
description: Required. A list of node selector
|
|
terms. The terms are ORed.
|
|
items:
|
|
description: A null or empty node selector term
|
|
matches no objects. The requirements of them
|
|
are ANDed. The TopologySelectorTerm type implements
|
|
a subset of the NodeSelectorTerm.
|
|
properties:
|
|
matchExpressions:
|
|
description: A list of node selector requirements
|
|
by node's labels.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchFields:
|
|
description: A list of node selector requirements
|
|
by node's fields.
|
|
items:
|
|
description: A node selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: The label key that the
|
|
selector applies to.
|
|
type: string
|
|
operator:
|
|
description: Represents a key's relationship
|
|
to a set of values. Valid operators
|
|
are In, NotIn, Exists, DoesNotExist.
|
|
Gt, and Lt.
|
|
type: string
|
|
values:
|
|
description: An array of string values.
|
|
If the operator is In or NotIn,
|
|
the values array must be non-empty.
|
|
If the operator is Exists or DoesNotExist,
|
|
the values array must be empty.
|
|
If the operator is Gt or Lt, the
|
|
values array must have a single
|
|
element, which will be interpreted
|
|
as an integer. This array is replaced
|
|
during a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: array
|
|
required:
|
|
- nodeSelectorTerms
|
|
type: object
|
|
type: object
|
|
podAffinity:
|
|
description: Describes pod affinity scheduling rules (e.g.
|
|
co-locate this pod in the same node, zone, etc. as some
|
|
other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling affinity expressions,
|
|
etc.), compute a sum by iterating through the elements
|
|
of this field and adding "weight" to the sum if
|
|
the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
affinity requirements specified by this field cease
|
|
to be met at some point during pod execution (e.g.
|
|
due to a pod label update), the system may or may
|
|
not try to eventually evict the pod from its node.
|
|
When there are multiple elements, the lists of nodes
|
|
corresponding to each podAffinityTerm are intersected,
|
|
i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
podAntiAffinity:
|
|
description: Describes pod anti-affinity scheduling rules
|
|
(e.g. avoid putting this pod in the same node, zone,
|
|
etc. as some other pod(s)).
|
|
properties:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
description: The scheduler will prefer to schedule
|
|
pods to nodes that satisfy the anti-affinity expressions
|
|
specified by this field, but it may choose a node
|
|
that violates one or more of the expressions. The
|
|
node that is most preferred is the one with the
|
|
greatest sum of weights, i.e. for each node that
|
|
meets all of the scheduling requirements (resource
|
|
request, requiredDuringScheduling anti-affinity
|
|
expressions, etc.), compute a sum by iterating through
|
|
the elements of this field and adding "weight" to
|
|
the sum if the node has pods which matches the corresponding
|
|
podAffinityTerm; the node(s) with the highest sum
|
|
are the most preferred.
|
|
items:
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
fields are added per-node to find the most preferred
|
|
node(s)
|
|
properties:
|
|
podAffinityTerm:
|
|
description: Required. A pod affinity term,
|
|
associated with the corresponding weight.
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of
|
|
resources, in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The
|
|
requirements are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label
|
|
key that the selector applies
|
|
to.
|
|
type: string
|
|
operator:
|
|
description: operator represents
|
|
a key's relationship to a set
|
|
of values. Valid operators are
|
|
In, NotIn, Exists and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array
|
|
of string values. If the operator
|
|
is In or NotIn, the values array
|
|
must be non-empty. If the operator
|
|
is Exists or DoesNotExist, the
|
|
values array must be empty.
|
|
This array is replaced during
|
|
a strategic merge patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of
|
|
{key,value} pairs. A single {key,value}
|
|
in the matchLabels map is equivalent
|
|
to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are
|
|
ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which
|
|
namespaces the labelSelector applies to
|
|
(matches against); null or empty list
|
|
means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located
|
|
(affinity) or not co-located (anti-affinity)
|
|
with the pods matching the labelSelector
|
|
in the specified namespaces, where co-located
|
|
is defined as running on a node whose
|
|
value of the label with key topologyKey
|
|
matches that of any node on which any
|
|
of the selected pods is running. Empty
|
|
topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
weight:
|
|
description: weight associated with matching
|
|
the corresponding podAffinityTerm, in the
|
|
range 1-100.
|
|
format: int32
|
|
type: integer
|
|
required:
|
|
- podAffinityTerm
|
|
- weight
|
|
type: object
|
|
type: array
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
description: If the anti-affinity requirements specified
|
|
by this field are not met at scheduling time, the
|
|
pod will not be scheduled onto the node. If the
|
|
anti-affinity requirements specified by this field
|
|
cease to be met at some point during pod execution
|
|
(e.g. due to a pod label update), the system may
|
|
or may not try to eventually evict the pod from
|
|
its node. When there are multiple elements, the
|
|
lists of nodes corresponding to each podAffinityTerm
|
|
are intersected, i.e. all terms must be satisfied.
|
|
items:
|
|
description: Defines a set of pods (namely those
|
|
matching the labelSelector relative to the given
|
|
namespace(s)) that this pod should be co-located
|
|
(affinity) or not co-located (anti-affinity) with,
|
|
where co-located is defined as running on a node
|
|
whose value of the label with key <topologyKey>
|
|
matches that of any node on which a pod of the
|
|
set of pods is running
|
|
properties:
|
|
labelSelector:
|
|
description: A label query over a set of resources,
|
|
in this case pods.
|
|
properties:
|
|
matchExpressions:
|
|
description: matchExpressions is a list
|
|
of label selector requirements. The requirements
|
|
are ANDed.
|
|
items:
|
|
description: A label selector requirement
|
|
is a selector that contains values,
|
|
a key, and an operator that relates
|
|
the key and values.
|
|
properties:
|
|
key:
|
|
description: key is the label key
|
|
that the selector applies to.
|
|
type: string
|
|
operator:
|
|
description: operator represents a
|
|
key's relationship to a set of values.
|
|
Valid operators are In, NotIn, Exists
|
|
and DoesNotExist.
|
|
type: string
|
|
values:
|
|
description: values is an array of
|
|
string values. If the operator is
|
|
In or NotIn, the values array must
|
|
be non-empty. If the operator is
|
|
Exists or DoesNotExist, the values
|
|
array must be empty. This array
|
|
is replaced during a strategic merge
|
|
patch.
|
|
items:
|
|
type: string
|
|
type: array
|
|
required:
|
|
- key
|
|
- operator
|
|
type: object
|
|
type: array
|
|
matchLabels:
|
|
additionalProperties:
|
|
type: string
|
|
description: matchLabels is a map of {key,value}
|
|
pairs. A single {key,value} in the matchLabels
|
|
map is equivalent to an element of matchExpressions,
|
|
whose key field is "key", the operator
|
|
is "In", and the values array contains
|
|
only "value". The requirements are ANDed.
|
|
type: object
|
|
type: object
|
|
namespaces:
|
|
description: namespaces specifies which namespaces
|
|
the labelSelector applies to (matches against);
|
|
null or empty list means "this pod's namespace"
|
|
items:
|
|
type: string
|
|
type: array
|
|
topologyKey:
|
|
description: This pod should be co-located (affinity)
|
|
or not co-located (anti-affinity) with the
|
|
pods matching the labelSelector in the specified
|
|
namespaces, where co-located is defined as
|
|
running on a node whose value of the label
|
|
with key topologyKey matches that of any node
|
|
on which any of the selected pods is running.
|
|
Empty topologyKey is not allowed.
|
|
type: string
|
|
required:
|
|
- topologyKey
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
nodeSelector:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
tolerations:
|
|
items:
|
|
description: The pod this Toleration is attached to tolerates
|
|
any taint that matches the triple <key,value,effect> using
|
|
the matching operator <operator>.
|
|
properties:
|
|
effect:
|
|
description: Effect indicates the taint effect to match.
|
|
Empty means match all taint effects. When specified,
|
|
allowed values are NoSchedule, PreferNoSchedule and
|
|
NoExecute.
|
|
type: string
|
|
key:
|
|
description: Key is the taint key that the toleration
|
|
applies to. Empty means match all taint keys. If the
|
|
key is empty, operator must be Exists; this combination
|
|
means to match all values and all keys.
|
|
type: string
|
|
operator:
|
|
description: Operator represents a key's relationship
|
|
to the value. Valid operators are Exists and Equal.
|
|
Defaults to Equal. Exists is equivalent to wildcard
|
|
for value, so that a pod can tolerate all taints of
|
|
a particular category.
|
|
type: string
|
|
tolerationSeconds:
|
|
description: TolerationSeconds represents the period
|
|
of time the toleration (which must be of effect NoExecute,
|
|
otherwise this field is ignored) tolerates the taint.
|
|
By default, it is not set, which means tolerate the
|
|
taint forever (do not evict). Zero and negative values
|
|
will be treated as 0 (evict immediately) by the system.
|
|
format: int64
|
|
type: integer
|
|
value:
|
|
description: Value is the taint value the toleration
|
|
matches to. If the operator is Exists, the value should
|
|
be empty, otherwise just a regular string.
|
|
type: string
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
selfSignConfiguration:
|
|
description: SelfSignConfiguration defines self sign configuration
|
|
properties:
|
|
caOverlapInterval:
|
|
description: CAOverlapInterval defines the duration where expired
|
|
CA certificate can overlap with new one, in order to allow fluent
|
|
CA rotation transitioning
|
|
type: string
|
|
caRotateInterval:
|
|
description: CARotateInterval defines duration for CA expiration
|
|
type: string
|
|
certOverlapInterval:
|
|
description: CertOverlapInterval defines the duration where expired
|
|
service certificate can overlap with new one, in order to allow
|
|
fluent service rotation transitioning
|
|
type: string
|
|
certRotateInterval:
|
|
description: CertRotateInterval defines duration for of service
|
|
certificate expiration
|
|
type: string
|
|
type: object
|
|
tlsSecurityProfile:
|
|
description: TLSSecurityProfile defines the schema for a TLS security
|
|
profile. This object is used by operators to apply TLS security
|
|
settings to operands.
|
|
nullable: true
|
|
properties:
|
|
custom:
|
|
description: 'custom is a user-defined TLS security profile. Be
|
|
extremely careful using a custom profile as invalid configurations
|
|
can be catastrophic. An example custom profile looks like this:
|
|
ciphers: ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256
|
|
minTLSVersion: TLSv1.1'
|
|
nullable: true
|
|
properties:
|
|
ciphers:
|
|
description: |-
|
|
ciphers is used to specify the cipher algorithms that are negotiated during the TLS handshake. Operators may remove entries their operands do not support. For example, to use DES-CBC3-SHA (yaml):
|
|
ciphers: - DES-CBC3-SHA
|
|
items:
|
|
enum:
|
|
- TLS_AES_128_GCM_SHA256
|
|
- TLS_AES_256_GCM_SHA384
|
|
- TLS_CHACHA20_POLY1305_SHA256
|
|
- ECDHE-ECDSA-AES128-GCM-SHA256
|
|
- ECDHE-RSA-AES128-GCM-SHA256
|
|
- ECDHE-ECDSA-AES256-GCM-SHA384
|
|
- ECDHE-RSA-AES256-GCM-SHA384
|
|
- ECDHE-ECDSA-CHACHA20-POLY1305
|
|
- ECDHE-RSA-CHACHA20-POLY1305
|
|
- DHE-RSA-AES128-GCM-SHA256
|
|
- DHE-RSA-AES256-GCM-SHA384
|
|
- DHE-RSA-CHACHA20-POLY1305
|
|
- ECDHE-ECDSA-AES128-SHA256
|
|
- ECDHE-RSA-AES128-SHA256
|
|
- ECDHE-ECDSA-AES128-SHA
|
|
- ECDHE-RSA-AES128-SHA
|
|
- ECDHE-ECDSA-AES256-SHA384
|
|
- ECDHE-RSA-AES256-SHA384
|
|
- ECDHE-ECDSA-AES256-SHA
|
|
- ECDHE-RSA-AES256-SHA
|
|
- DHE-RSA-AES128-SHA256
|
|
- DHE-RSA-AES256-SHA256
|
|
- AES128-GCM-SHA256
|
|
- AES256-GCM-SHA384
|
|
- AES128-SHA256
|
|
- AES256-SHA256
|
|
- AES128-SHA
|
|
- AES256-SHA
|
|
- DES-CBC3-SHA
|
|
type: string
|
|
type: array
|
|
minTLSVersion:
|
|
description: |-
|
|
minTLSVersion is used to specify the minimal version of the TLS protocol that is negotiated during the TLS handshake. For example, to use TLS versions 1.1, 1.2 and 1.3 (yaml):
|
|
minTLSVersion: TLSv1.1
|
|
NOTE: currently the highest minTLSVersion allowed is VersionTLS12
|
|
enum:
|
|
- VersionTLS10
|
|
- VersionTLS11
|
|
- VersionTLS12
|
|
- VersionTLS13
|
|
type: string
|
|
type: object
|
|
intermediate:
|
|
description: |-
|
|
intermediate is a TLS security profile based on: https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29 and looks like this (yaml):
|
|
ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128-GCM-SHA256 - ECDHE-RSA-AE,SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AE,SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE,POLY1305,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES256-GCM-SHA384 minTLSVersion: TLSv1.2
|
|
nullable: true
|
|
type: object
|
|
modern:
|
|
description: 'modern is a TLS security profile based on: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
|
|
and looks like this (yaml): ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256
|
|
minTLSVersion: TLSv1.3 NOTE: Currently unsupported.'
|
|
nullable: true
|
|
type: object
|
|
old:
|
|
description: 'old is a TLS security profile based on: https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
|
|
and looks like this (yaml): ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES256-GCM-SHA384,DHE-RSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-RSA-AES128-SHA256,DHE-RSA-AES256-SHA256,AES128-GCM-SHA256,AES256-GCM-SHA384,AES128-SHA256,AES256-SHA256,AES128-SHA,AES256-SHA,DES-CBC3-SHA
|
|
minTLSVersion: TLSv1.0'
|
|
nullable: true
|
|
type: object
|
|
type:
|
|
description: |-
|
|
type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. Old, Intermediate and Modern are TLS security profiles based on:
|
|
https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.
|
|
Note that the Modern profile is currently not supported because it is not yet well adopted by common software libraries.
|
|
enum:
|
|
- Old
|
|
- Intermediate
|
|
- Modern
|
|
- Custom
|
|
type: string
|
|
type: object
|
|
type: object
|
|
status:
|
|
description: NetworkAddonsConfigStatus defines the observed state of NetworkAddonsConfig
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: Condition represents the state of the operator's reconciliation
|
|
functionality.
|
|
properties:
|
|
lastHeartbeatTime:
|
|
format: date-time
|
|
nullable: true
|
|
type: string
|
|
lastTransitionTime:
|
|
format: date-time
|
|
nullable: true
|
|
type: string
|
|
message:
|
|
type: string
|
|
reason:
|
|
type: string
|
|
status:
|
|
type: string
|
|
type:
|
|
description: ConditionType is the state of the operator's reconciliation
|
|
functionality.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
containers:
|
|
items:
|
|
properties:
|
|
image:
|
|
type: string
|
|
name:
|
|
type: string
|
|
parentKind:
|
|
type: string
|
|
parentName:
|
|
type: string
|
|
required:
|
|
- image
|
|
- name
|
|
- parentKind
|
|
- parentName
|
|
type: object
|
|
type: array
|
|
observedVersion:
|
|
type: string
|
|
operatorVersion:
|
|
type: string
|
|
targetVersion:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: false
|
|
subresources:
|
|
status: {}
|
|
preserveUnknownFields: false
|