infra/crds-catalog
1
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

auto-update crds catalog

Browse Source
This commit is contained in:
Drone Shipper 2024-02-02 18:37:20 +00:00
parent c957fbbd39
commit 75e06aa74c
4 changed files with 347 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

108
cert-manager.io/certificate_v1.json
View File

@ -168,6 +168,15 @@
} }
}, },
"additionalProperties": false "additionalProperties": false
},
"profile": {
"description": "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. \n If provided, allowed values are: `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms (eg. because of company policy). Please note that the security of the algorithm is not that important in reality, because the unencrypted certificate and private key are also stored in the Secret.",
"type": "string",
"enum": [
"LegacyRC2",
"LegacyDES",
"Modern2023"
]
} }
}, },
"additionalProperties": false "additionalProperties": false
@ -179,6 +188,105 @@
"description": "Requested X.509 certificate subject, represented using the LDAP \"String Representation of a Distinguished Name\" [1]. Important: the LDAP string format also specifies the order of the attributes in the subject, this is important when issuing certs for LDAP authentication. Example: `CN=foo,DC=corp,DC=example,DC=com` More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 More info: https://github.com/cert-manager/cert-manager/issues/3203 More info: https://github.com/cert-manager/cert-manager/issues/4424 \n Cannot be set if the `subject` or `commonName` field is set. This is an Alpha Feature and is only enabled with the `--feature-gates=LiteralCertificateSubject=true` option set on both the controller and webhook components.", "description": "Requested X.509 certificate subject, represented using the LDAP \"String Representation of a Distinguished Name\" [1]. Important: the LDAP string format also specifies the order of the attributes in the subject, this is important when issuing certs for LDAP authentication. Example: `CN=foo,DC=corp,DC=example,DC=com` More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 More info: https://github.com/cert-manager/cert-manager/issues/3203 More info: https://github.com/cert-manager/cert-manager/issues/4424 \n Cannot be set if the `subject` or `commonName` field is set. This is an Alpha Feature and is only enabled with the `--feature-gates=LiteralCertificateSubject=true` option set on both the controller and webhook components.",
"type": "string" "type": "string"
}, },
"nameConstraints": {
"description": "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 \n This is an Alpha Feature and is only enabled with the `--feature-gates=NameConstraints=true` option set on both the controller and webhook components.",
"type": "object",
"properties": {
"critical": {
"description": "if true then the name constraints are marked critical.",
"type": "boolean"
},
"excluded": {
"description": "Excluded contains the constraints which must be disallowed. Any name matching a restriction in the excluded field is invalid regardless of information appearing in the permitted",
"type": "object",
"properties": {
"dnsDomains": {
"description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
"type": "array",
"items": {
"type": "string"
}
},
"emailAddresses": {
"description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
"type": "array",
"items": {
"type": "string"
}
},
"ipRanges": {
"description": "IPRanges is a list of IP Ranges that are permitted or excluded. This should be a valid CIDR notation.",
"type": "array",
"items": {
"type": "string"
}
},
"uriDomains": {
"description": "URIDomains is a list of URI domains that are permitted or excluded.",
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
"permitted": {
"description": "Permitted contains the constraints in which the names must be located.",
"type": "object",
"properties": {
"dnsDomains": {
"description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
"type": "array",
"items": {
"type": "string"
}
},
"emailAddresses": {
"description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
"type": "array",
"items": {
"type": "string"
}
},
"ipRanges": {
"description": "IPRanges is a list of IP Ranges that are permitted or excluded. This should be a valid CIDR notation.",
"type": "array",
"items": {
"type": "string"
}
},
"uriDomains": {
"description": "URIDomains is a list of URI domains that are permitted or excluded.",
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"otherNames": {
"description": "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.",
"type": "array",
"items": {
"type": "object",
"properties": {
"oid": {
"description": "OID is the object identifier for the otherName SAN. The object identifier must be expressed as a dotted string, for example, \"1.2.840.113556.1.4.221\".",
"type": "string"
},
"utf8Value": {
"description": "utf8Value is the string value of the otherName SAN. The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.",
"type": "string"
}
},
"additionalProperties": false
}
},
"privateKey": { "privateKey": {
"description": "Private key options. These include the key algorithm and size, the used encoding and the rotation policy.", "description": "Private key options. These include the key algorithm and size, the used encoding and the rotation policy.",
"type": "object", "type": "object",

86
cert-manager.io/challenge_v1.json
View File

@ -183,11 +183,11 @@
], ],
"properties": { "properties": {
"clientID": { "clientID": {
"description": "if both this and ClientSecret are left unset MSI will be used", "description": "Auth: Azure Service Principal: The ClientID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientSecret and TenantID must also be set.",
"type": "string" "type": "string"
}, },
"clientSecretSecretRef": { "clientSecretSecretRef": {
"description": "if both this and ClientID are left unset MSI will be used", "description": "Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set.",
"type": "object", "type": "object",
"required": [ "required": [
"name" "name"
@ -219,7 +219,7 @@
"type": "string" "type": "string"
}, },
"managedIdentity": { "managedIdentity": {
"description": "managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID", "description": "Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.",
"type": "object", "type": "object",
"properties": { "properties": {
"clientID": { "clientID": {
@ -227,7 +227,7 @@
"type": "string" "type": "string"
}, },
"resourceID": { "resourceID": {
"description": "resource ID of the managed identity, can not be used at the same time as clientID", "description": "resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity",
"type": "string" "type": "string"
} }
}, },
@ -242,7 +242,7 @@
"type": "string" "type": "string"
}, },
"tenantID": { "tenantID": {
"description": "when specifying ClientID and ClientSecret then this field is also needed", "description": "Auth: Azure Service Principal: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set.",
"type": "string" "type": "string"
} }
}, },
@ -541,14 +541,14 @@
"minLength": 1 "minLength": 1
}, },
"namespace": { "namespace": {
"description": "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. \n Support: Core", "description": "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n <gateway:experimental:description> ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. </gateway:experimental:description> \n Support: Core",
"type": "string", "type": "string",
"maxLength": 63, "maxLength": 63,
"minLength": 1, "minLength": 1,
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
}, },
"port": { "port": {
"description": "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>", "description": "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n <gateway:experimental:description> When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. </gateway:experimental:description> \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>",
"type": "integer", "type": "integer",
"format": "int32", "format": "int32",
"maximum": 65535, "maximum": 65535,
@ -850,7 +850,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -894,6 +894,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -973,7 +989,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1017,6 +1033,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1103,7 +1135,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1147,6 +1179,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1226,7 +1274,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1270,6 +1318,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",

93
cert-manager.io/clusterissuer_v1.json
View File

@ -240,11 +240,11 @@
], ],
"properties": { "properties": {
"clientID": { "clientID": {
"description": "if both this and ClientSecret are left unset MSI will be used", "description": "Auth: Azure Service Principal: The ClientID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientSecret and TenantID must also be set.",
"type": "string" "type": "string"
}, },
"clientSecretSecretRef": { "clientSecretSecretRef": {
"description": "if both this and ClientID are left unset MSI will be used", "description": "Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set.",
"type": "object", "type": "object",
"required": [ "required": [
"name" "name"
@ -276,7 +276,7 @@
"type": "string" "type": "string"
}, },
"managedIdentity": { "managedIdentity": {
"description": "managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID", "description": "Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.",
"type": "object", "type": "object",
"properties": { "properties": {
"clientID": { "clientID": {
@ -284,7 +284,7 @@
"type": "string" "type": "string"
}, },
"resourceID": { "resourceID": {
"description": "resource ID of the managed identity, can not be used at the same time as clientID", "description": "resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity",
"type": "string" "type": "string"
} }
}, },
@ -299,7 +299,7 @@
"type": "string" "type": "string"
}, },
"tenantID": { "tenantID": {
"description": "when specifying ClientID and ClientSecret then this field is also needed", "description": "Auth: Azure Service Principal: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set.",
"type": "string" "type": "string"
} }
}, },
@ -598,14 +598,14 @@
"minLength": 1 "minLength": 1
}, },
"namespace": { "namespace": {
"description": "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. \n Support: Core", "description": "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n <gateway:experimental:description> ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. </gateway:experimental:description> \n Support: Core",
"type": "string", "type": "string",
"maxLength": 63, "maxLength": 63,
"minLength": 1, "minLength": 1,
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
}, },
"port": { "port": {
"description": "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>", "description": "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n <gateway:experimental:description> When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. </gateway:experimental:description> \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>",
"type": "integer", "type": "integer",
"format": "int32", "format": "int32",
"maximum": 65535, "maximum": 65535,
@ -907,7 +907,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -951,6 +951,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1030,7 +1046,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1074,6 +1090,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1160,7 +1192,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1204,6 +1236,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1283,7 +1331,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1327,6 +1375,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1521,6 +1585,13 @@
"type": "string" "type": "string"
} }
}, },
"issuingCertificateURLs": {
"description": "IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be \"http://ca.domain.com/ca.crt\".",
"type": "array",
"items": {
"type": "string"
}
},
"ocspServers": { "ocspServers": {
"description": "The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".", "description": "The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".",
"type": "array", "type": "array",

93
cert-manager.io/issuer_v1.json
View File

@ -240,11 +240,11 @@
], ],
"properties": { "properties": {
"clientID": { "clientID": {
"description": "if both this and ClientSecret are left unset MSI will be used", "description": "Auth: Azure Service Principal: The ClientID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientSecret and TenantID must also be set.",
"type": "string" "type": "string"
}, },
"clientSecretSecretRef": { "clientSecretSecretRef": {
"description": "if both this and ClientID are left unset MSI will be used", "description": "Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set.",
"type": "object", "type": "object",
"required": [ "required": [
"name" "name"
@ -276,7 +276,7 @@
"type": "string" "type": "string"
}, },
"managedIdentity": { "managedIdentity": {
"description": "managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID", "description": "Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set.",
"type": "object", "type": "object",
"properties": { "properties": {
"clientID": { "clientID": {
@ -284,7 +284,7 @@
"type": "string" "type": "string"
}, },
"resourceID": { "resourceID": {
"description": "resource ID of the managed identity, can not be used at the same time as clientID", "description": "resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity",
"type": "string" "type": "string"
} }
}, },
@ -299,7 +299,7 @@
"type": "string" "type": "string"
}, },
"tenantID": { "tenantID": {
"description": "when specifying ClientID and ClientSecret then this field is also needed", "description": "Auth: Azure Service Principal: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set.",
"type": "string" "type": "string"
} }
}, },
@ -598,14 +598,14 @@
"minLength": 1 "minLength": 1
}, },
"namespace": { "namespace": {
"description": "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. \n Support: Core", "description": "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n <gateway:experimental:description> ParentRefs from a Route to a Service in the same namespace are \"producer\" routes, which apply default routing rules to inbound connections from any namespace to the Service. \n ParentRefs from a Route to a Service in a different namespace are \"consumer\" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. </gateway:experimental:description> \n Support: Core",
"type": "string", "type": "string",
"maxLength": 63, "maxLength": 63,
"minLength": 1, "minLength": 1,
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
}, },
"port": { "port": {
"description": "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>", "description": "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n <gateway:experimental:description> When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. </gateway:experimental:description> \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n <gateway:experimental>",
"type": "integer", "type": "integer",
"format": "int32", "format": "int32",
"maximum": 65535, "maximum": 65535,
@ -907,7 +907,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -951,6 +951,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1030,7 +1046,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1074,6 +1090,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1160,7 +1192,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1204,6 +1236,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1283,7 +1331,7 @@
], ],
"properties": { "properties": {
"labelSelector": { "labelSelector": {
"description": "A label query over a set of resources, in this case pods.", "description": "A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.",
"type": "object", "type": "object",
"properties": { "properties": {
"matchExpressions": { "matchExpressions": {
@ -1327,6 +1375,22 @@
"x-kubernetes-map-type": "atomic", "x-kubernetes-map-type": "atomic",
"additionalProperties": false "additionalProperties": false
}, },
"matchLabelKeys": {
"description": "MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"mismatchLabelKeys": {
"description": "MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.",
"type": "array",
"items": {
"type": "string"
},
"x-kubernetes-list-type": "atomic"
},
"namespaceSelector": { "namespaceSelector": {
"description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.", "description": "A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means \"this pod's namespace\". An empty selector ({}) matches all namespaces.",
"type": "object", "type": "object",
@ -1521,6 +1585,13 @@
"type": "string" "type": "string"
} }
}, },
"issuingCertificateURLs": {
"description": "IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be \"http://ca.domain.com/ca.crt\".",
"type": "array",
"items": {
"type": "string"
}
},
"ocspServers": { "ocspServers": {
"description": "The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".", "description": "The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".",
"type": "array", "type": "array",